QSAN Storage Manager <3.3.3 - Cross-Site Scripting Detection

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. !/usr/bin/env python3 -- coding: utf-8 -- """QSAN Storage Manager before...

Apache Filename Enumeration Detection

If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error containing a pseudo directory listing. !/usr/bin/env python3 -- coding: utf-8 -- """If the client provides an invalid Accept header, the server will respond with a 406 Not Acceptable error...

HighMail Admin Login Panel - Detect

HighMail admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HighMail admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HighMail Admin Login Panel - Detect',...

Revive Adserver <=5.0.3 - Cross-Site Scripting Detection

Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php...

Kodi Plugin Generator

Kodi Plugin Generator for Kodi 19 from kittysploit import import zipfile import os class ModuleBackdoor: info = 'name': 'Kodi Plugin Generator', 'description': 'Kodi Plugin Generator for Kodi 19', 'author': 'KittySploit Team', 'arch': Arch.X86, Arch.X64, lhost = OptIP'','Connect-back IP address',...

Joget Workflow Enterprise JasperReports jrxml Expression Injection RCE — Detect

Fingerprint / reachability check for Joget Workflow Enterprise JasperReports jrxml Expression Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Joget Workflow Enterprise JasperReports jrxml Expression Injection RCE""" from kittysploit import from lib.protocols.http.httpclie...

Stimulsoft Server Unauthenticated Report Script RCE — Detect

Fingerprint / reachability check for Stimulsoft Server Unauthenticated Report Script RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Stimulsoft Server Unauthenticated Report Script RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Telaeris XPressEntry Unauthenticated SQL Injection RCE — Detect

Fingerprint / reachability check for Telaeris XPressEntry Unauthenticated SQL Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Telaeris XPressEntry Unauthenticated SQL Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xp_cmdshell RCE — Detect

Fingerprint / reachability check for Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xpcmdshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xpcmdshell RCE""" from kittysploit import from lib.protocols.http.httpclient impor...

CVE-2026-26128 SMB Relay Privesc (from shell)

Post-exploitation wrapper for CVE-2026-26128: reads domain identity from an active Windows shell session, then launches the ADIDNS Unicode hostname + Kerberos coercion + SMB relay chain. Operator must still supply password, listener IP, and relay target AD CS or MSSQL. !/usr/bin/env python3 --...

RomPager Misfortune Cookie Auth Bypass (CVE-2014-9222)

Exploits CVE-2014-9222 in Allegro RomPager: malformed C107373883 cookie bypasses authentication on embedded device admin interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie auth bypass CVE-2014-9222.""" from kittysploit import from...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

Sangoma Switchvox CVE-2026-9586 SQLi Detect

Detects CVE-2026-9586 in Sangoma Switchvox SMB before 8.4.0.2. The unauthenticated /pa phone-notification endpoint concatenates XML PhoneIP values into PostgreSQL queries. Uses a benign syntax-error probe only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Sangoma Switchvox CVE-2026-9586...

FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

Apache HTTP Server - Path Traversal File Read (CVE-2021-41773/42013)

Reads arbitrary files via CVE-2021-41773 / CVE-2021-42013 encoded path traversal under cgi-bin/icons aliases. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server path-traversal arbitrary file read CVE-2021-41773 / CVE-2021-42013.""" from kittysploit import from...

Uncanny Toolkit for LearnDash - Open Redirection Detection

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. !/usr/bin/env python3 -- coding: utf-8 -- ""...

TP-LINK - Local File Inclusion Detection

TP-LINK is susceptible to local file inclusion in these products: Archer C5 1.2 with firmware before 150317, Archer C7 2.0 with firmware before 150304, and C8 1.0 with firmware before 150316, Archer C9 1.0, TL-WDR3500 1.0, TL-WDR3600 1.0, and TL-WDR4300 1.0 with firmware before 150302, TL-WR740N...

Homer Panel - Detect

A simple static homepage was discovered !/usr/bin/env python3 -- coding: utf-8 -- """A simple static homepage was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Homer Panel - Detect', 'description': 'A...

AWS Secret Key Detection

Detects AWS Access Key ID + Secret Key co-occurring in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AWS Secret Key.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Secret Key...

Pinata API Key - Expose Detection

Detects Pinata API Key - Expose. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pinata API Key - Expose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pinata API Key - Expose Detection', 'description': 'Detec...

Oracle Application Server test-cgi Page Detection

Detects Oracle Application Server test-cgi Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle Application Server test-cgi Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Application Server...

Jenkins - Remote Code Execution Detection

Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality.""" from kittysploit import from...

LocalGPT Panel - Detect

LocalGPT is an open-source project that allows users to chat with their documents locally using LLMs with no data leaving their device !/usr/bin/env python3 -- coding: utf-8 -- """LocalGPT is an open-source project that allows users to chat with their documents locally using LLMs with no d.""" fr...

Dell Wyse Management Suite Login Panel - Detect

Dell Wyse Management Suite login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dell Wyse Management Suite login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dell Wyse...

WordPress AI Engine Plugin - Token Exposure Detection

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.""" import r...

Argus Surveillance DVR 4.0.0.0 - Local File Inclusion Detection

Argus Surveillance DVR 4.0.0.0 devices allow unauthenticated local file inclusion, leading to file disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Argus Surveillance DVR 4.""" from kittysploit import from lib.protocols.http.httpclien...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

Temenos T24 R20 - Cross-Site Scripting Detection

Temenos T24 release 20 contains a reflected cross-site scripting vulnerability via the routineName parameter at genrequest.jsp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

FileZilla FTP Service - Detect

FileZilla FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FileZilla FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'FileZilla FTP Servic...

WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting Detection

WSO2 Management Console through 5.10 is susceptible to reflected cross-site scripting which can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 Manageme...

Microsoft Runtime Error Page Detection

Detects Microsoft Runtime Error Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Microsoft Runtime Error Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft Runtime Error Page Detection',...

Directory listing detection

Detects if directory listing is enabled on the server. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient PATHSTOCHECK = "/", "/images/", "/img/", "/assets/", "/static/", "/backup/", "/uploads/", "/files/", "/media/" class...

LiteLLM proxy_admin Privesc (CVE-2026-47101)

Post-exploitation variant of CVE-2026-47101: escalates an internaluser API key to proxyadmin via /key/generate wildcard routes and /user/update. Reads host, port, TLS, and keys from the active HTTP session when present. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM CVE-2026-47101 — post...

Sandbox Evasion Loader

Apply sandbox heuristics RAM/CPU/disk, mouse movement, sleep timing and only execute decrypted shellcode when the environment looks benign. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

Thread Pool Injection Evasion

Decrypt shellcode and queue it as a TpAllocWait/TpSetWait thread-pool callback no CreateThread on the payload path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from lib.compile.threadpoolinjection...

Joomla Simple Membership CVE-2026-102782 SQL injection

CVE-2026-102782 comsimplemembership 7.4.0: unauthenticated SQL injection on task=checkLoginPass via the login parameter. Uses error-based extractvalue to leak SQL subquery results leak. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla OrdaSoft Simple Membership CVE-2026-102782 unauth SQLi."""...

Valkey/Redis CVE-2026-25243 RESTORE RCE trigger

CVE-2026-25243: malformed RESTORE payload with DEBUG SET-SKIP-CHECKSUM-VALIDATION can corrupt memory / crash server requires --enable-debug-command on vulnerable builds. !/usr/bin/env python3 -- coding: utf-8 -- """Redis/Valkey CVE-2026-25243 RESTORE zipmap memory corruption trigger.""" from futu...

ManageEngine ServiceDesk RCE (CVE-2021-44077)

Exploits CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus: unauthenticated zip upload to /RestAPI/ImportTechnicians achieves path traversal and RCE. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus ImportTechnicians RCE CVE-2021-44077.""" import io import zipfile fro...

WP Download Manager Shortcode RCE (CVE-2024-11740)

Exploits CVE-2024-11740 in WordPress Download Manager 3.3.04: unauthenticated arbitrary shortcode execution via wpdmxp query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Download Manager shortcode execution CVE-2024-11740.""" from kittysploit import from...

Zyxel NAS zylog RCE (CVE-2023-27992)

Exploits CVE-2023-27992 in Zyxel NAS: pre-auth command injection via configuremailsyslog after auth-bypass path /cmd,/ck6fup6/zylogmain/. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS zylog pre-auth command injection CVE-2023-27992.""" import re import urllib.parse from kittysploit impor...

Capability Probe (PowerShell)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe...

Resource Guard (PowerShell)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard PowerShell", "description": "Exit early whe...

Synology DSM - imageSelector.cgi RCE (CVE-2013-6955)

Exploits CVE-2013-6955 by appending shell commands into redirect.cgi via imageSelector.cgi SLICEUPLOAD, then reading output from /redirect.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM imageSelector.cgi RCE CVE-2013-6955 — execute session."""...

Blocksy Companion <= 2.1.46 - Unauthenticated File Upload RCE (CVE-2026-58480)

CVE-2026-58480: unauthenticated arbitrary file upload via blc-review-images in blcsavereviewattachments. Double-extension bypass .woff2.php when Advanced Reviews and Custom Fonts are enabled. Fixed in 2.1.47. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json...

Orkes Conductor CVE-2026-58138 (unauthenticated RCE) detection

Detects Conductor OSS / Orkes Conductor instances running a version below 3.30.2 that may be vulnerable to CVE-2026-58138 unauthenticated INLINE JavaScript RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Orkes Conductor / Conductor OSS instances vulnerable to CVE-2026-58138.""" from futu...

Netcore/Netis - UDP Backdoor Detection (CVE-2025-34117)

Detects Netcore/Netis UDP backdoor on port 53413 by sending XXXXXXXXnetcore and matching Login successed. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore/Netis UDP backdoor on port 53413 CVE-2025-34117 / 2014 disclosure.""" import socket from kittysploit import from...

ManageEngine SDP - FILENAME File Read (CVE-2011-2757)

Reads arbitrary files via CVE-2011-2757 FileDownload.jsp FILENAME traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2011-2757 FileDownload.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...

JTL Shop CVE-2026-54390 Smarty SSTI Detect

Detects JTL Shop 5.2.0 through 5.7.1 vulnerable to CVE-2026-54390: contact form fields reach SmartyRenderer email subjects via fetch'string:' . $subject. Versions 5.4.0+ allow full RCE via registered Smarty modifiers; 5.2.x–5.3.x allow credential theft. !/usr/bin/env python3 -- coding: utf-8 --...