Orkes Conductor CVE-2026-58138 (unauthenticated RCE) detection

Detects Conductor OSS / Orkes Conductor instances running a version below 3.30.2 that may be vulnerable to CVE-2026-58138 unauthenticated INLINE JavaScript RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Orkes Conductor / Conductor OSS instances vulnerable to CVE-2026-58138.""" from futu...

ManageEngine SDP - FILENAME File Read (CVE-2011-2757)

Reads arbitrary files via CVE-2011-2757 FileDownload.jsp FILENAME traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2011-2757 FileDownload.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

Apache HTTP Server 2.4.49 - CGI Path Traversal RCE (CVE-2021-41773)

Exploits CVE-2021-41773 by POSTing shell commands to an encoded path ending in bin/sh under a mapped Alias/ScriptAlias cgi-bin/icons. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache HTTP Server 2.4.49 CGI path-traversal RCE CVE-2021-41773 — opens execute...

JTL Shop CVE-2026-54390 Smarty SSTI Detect

Detects JTL Shop 5.2.0 through 5.7.1 vulnerable to CVE-2026-54390: contact form fields reach SmartyRenderer email subjects via fetch'string:' . $subject. Versions 5.4.0+ allow full RCE via registered Smarty modifiers; 5.2.x–5.3.x allow credential theft. !/usr/bin/env python3 -- coding: utf-8 --...

D-Link DCS - Unauth Credential Disclosure Detection (CVE-2020-25078)

Detects CVE-2020-25078 by requesting /config/getuser?index=0 and looking for name=/pass= credential lines without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS IP camera credential disclosure via /config/getuser CVE-2020-25078.""" import re from kittysploit import from...

Niagara Fox Protocol Information Enumeration Detection

Niagara Fox Protocol is a building automation protocol used between the Niagara software systems by Tridium. !/usr/bin/env python3 -- coding: utf-8 -- """Niagara Fox Protocol is a building automation protocol used between the Niagara software systems by Tridium.""" import socket from kittysploit...

FiftyOne Panel - Detect

FiftyOne, an open-source dataset visualization and curation tool for computer vision workflows built by Voxel51, was detected. The app ships with no authentication by default, so any exposed instance directly served browsable dataset content images, labels, metadata to unauthenticated visitors. T...

Huijietong - Local File Inclusion Detection

Huijietong is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Huijietong is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Huijietong -...

Krpano Panorama Viewer - Detection

Detected Krpano Panorama Viewer by identifying known Krpano-specific resources and response patterns. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Krpano Panorama Viewer by identifying known Krpano-specific resources and response patterns.""" from kittysploit import from...

3CX Phone System - Installer Page Exposure Detection

A 3CX Phone System installer or setup wizard page is publicly accessible. This web-based configuration tool is used for initial PBX setup including admin credential creation, SIP trunk configuration, license activation, and network settings. Exposure of this page allows unauthenticated attackers ...

Kentico Xperience 13 CMS - Staging None-password Authentication Bypass

Kentico Staging SyncServer None-type password handling auth bypass WT-2025-0006. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging None-password Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Mastodon - Open Redirect Detection

Mastodon version 4.5.8, 4.4.15, 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. !/usr/bin/env python3 -- coding: utf-8 -- """Mastodon version 4.""" import re from kittysploit import from...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting Detection

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. !/usr/bin/env python3 --...

Nimble Streamer <=3.5.4-9 - Local File Inclusion Detection

Nimble Streamer 3.0.2-2 through 3.5.4-9 is vulnerable to local file inclusion. An attacker can traverse the file system to access files or directories that are outside of the restricted directory on the remote server. !/usr/bin/env python3 -- coding: utf-8 -- """Nimble Streamer 3.""" import re fr...

Adobe Connect Central Version Detection

Detects Adobe Connect Central Version. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe Connect Central Version.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe Connect Central Version Detection',...

OneDev < 4.0.3 - User Access Token Leak Detection

OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. !/usr/bin/env pytho...

EPrints 3.4.2 - Cross-Site Scripting Detection

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. !/usr/bin/env python3 -- coding: utf-8 -- """EPrints 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

Redis Enterprise - Detect

Detects Redis Enterprise - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Redis Enterprise - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Redis Enterprise - Detect', 'description': 'Detects...

MantisBT < 2.25.2 - Cross-Site Scripting Detection

MantisBT before 2.25.2 contains a cross-site scripting vulnerability in browsersearchplugin.php. The application does not properly sanitize the 'type' parameter, which allows attackers to inject arbitrary web script or HTML via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """MantisBT...

NI Web-based Configuration & Monitoring - Detect

Detects NI Web-based Configuration & Monitoring - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects NI Web-based Configuration & Monitoring - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NI...

Pi-hole Login Panel - Detect

Detects Pi-hole Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pi-hole Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pi-hole Login Panel - Detect', 'description':...

Jan AI - Detect

Detects the Jan AI local server, an open-source ChatGPT alternative that runs models locally and exposes a Cortex-powered, OpenAI-compatible API default port 1337. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the Jan AI local server, an open-source ChatGPT alternative that runs models...

Lighttpd Config File - File Disclosure Detection

Lighttpd Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Lighttpd Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lighttpd Config File - File Disclosure Detection',...

MeteoBridge - Detect

Exposed MeteoBridge devices by identifying their unique HTTP response patterns. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed MeteoBridge devices by identifying their unique HTTP response patterns.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FreePBX - CVE-2025-57819 Backdoor Detection

FreePBX backdoor cleanup script used in 0-day exploitation of CVE-2025-57819 was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX backdoor cleanup script used in 0-day exploitation of CVE-2025-57819 was detected.""" from kittysploit import from lib.protocols.http.httpclient import...

TamronOS IPTV/VOD - Remote Command Execution Detection

TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint.""" import re from kittysploit import from...

Cockpit Project Login Panel - Detect

Cockpit Project products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cockpit Project products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cockpit Project Login Panel - Detect',...

PHP LDAP Admin Panel - Detect

Detects PHP LDAP Admin Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP LDAP Admin Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP LDAP Admin Panel - Detect', 'description'...

Splunk HEC - Detect

Splunk HCE HTTP Event Collector HEC was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk HCE HTTP Event Collector HEC was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Splunk HEC - Detect',...

LocalStack - Detect

LocalStack localstack.cloud / github.com/localstack/localstack is a local AWS cloud-service emulator widely used in development and CI. It typically listens on TCP 4566 and exposes an unauthenticated /localstack/health endpoint that lists every emulated service and its enabled state. An exposed...

Windmill/Nextcloud Flow < 1.603.3 - Unauthenticated Path Traversal Detection

Windmill 1.603.3 contains a path traversal caused by unsanitized filename parameter in getlogfile endpoint, letting unauthenticated attackers read arbitrary files on the server, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Windmill 1.""" from kittysploit import...

Check Point Quantum Gateway - Information Disclosure Detection

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available. !/usr/bin/env python3 -- coding: utf-8 -...

HiveQueue Agent Detection

HiveQueue Agent is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """HiveQueue Agent is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HiveQueue Agent Detection', 'description': 'HiveQueue Agent is...

Apache Kafka Consumer Offset Monitor Panel - Detect

Apache Kafka Consumer Offset Monitor panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Kafka Consumer Offset Monitor panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache...

Apache dubbo detect

Detects Apache dubbo detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache dubbo detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache dubbo detect', 'description': 'Detects Apache dubbo...

Windows UAC Bypass — FodHelper

HKCU ms-settings Shell Open command hijack + fodhelper.exe DelegateExecute, then registry cleanup. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.uacbypass import REGMSSETTINGS, UACAGENT, UacBypassMixin class ModulePost, UacBypassMixin: info = "name":...

Modbus session acquire

Opens a Modbus TCP session and registers it in the framework session list for follow-on OT modules and the Modbus shell. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from core.framework.basemodule import ModuleResult from lib.protocols.ics.constants import ICSPROTOCOLPORTS fr...

WiFi Probe Request Scanner

Capture 802.11 probe requests on a monitor-mode interface to reveal SSID names including hidden networks and client MAC addresses. !/usr/bin/env python3 -- coding: utf-8 -- """Sniff 802.11 probe requests to discover SSIDs and probing clients.""" from future import annotations from typing import...

Redis Listener

Redis in-memory store listener - creates interactive Redis shell session !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import import redis class ModuleListener: info = 'name': 'Redis Listener', 'description': 'Redis in-memory store listener - creates interactive Redis shell session',...

Windows Gather Local User Account Password Hashes (Registry)

Dumps local user account password hashes from the SAM database using registry access. Requires SYSTEM privileges. !/usr/bin/env python3 -- coding: utf-8 -- """ Windows Gather Local User Account Password Hashes Registry Extracts password hashes from the SAM database using registry access """ from...

PHP Injection Scanner

Scans for PHP injection vulnerabilities including code injection, command injection, file inclusion, and deserialization !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult import...

Metasploitable Environment

Metasploitable Linux - Intentionally vulnerable Linux distribution for penetration testing !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import class ModuleDockerEnvironment: info = 'name': 'Metasploitable Environment', 'description': 'Metasploitable Linux - Intentionally vulnerable...

Software AG webMethods MSR — XSLT Xalan Java-Extension RCE (Default Credentials) — Detect

Fingerprint / reachability check for Software AG webMethods MSR — XSLT Xalan Java-Extension RCE Default Credentials !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Software AG webMethods MSR — XSLT Xalan Java-Extension RCE Default Credentials""" from kittysploit import from...

vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE — Detect

Fingerprint / reachability check for vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Sett — Detect

Fingerprint / reachability check for CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Settings Root Directory Field CWE-93 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Settings Roo...

nginx-ui CVE-2026-27944 backup encryption key leak

CVE-2026-27944 2.3.3: unauthenticated GET /api/backup returns a full system backup ZIP and exposes the AES key in the X-Backup-Security response header, allowing offline decryption of credentials and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-27944 — nginx-ui...

OpenSSL CVE-2014-0160 Heartbleed memory leak

CVE-2014-0160: malformed TLS heartbeat on OpenSSL 1.0.1–1.0.1f returns up to 64KB of process memory per request. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSSL CVE-2014-0160 Heartbleed TLS memory disclosure.""" from future import annotations from kittysploit import from lib.exploit.handler...

Cacti CVE-2025-24367 graph template RCE

CVE-2025-24367 Cacti = 1.2.28: newline injection in graph template rightaxislabel breaks out of rrdtool arguments and writes PHP to the web root. Authenticated; plants a ?c= webshell and runs the given command. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2025-24367 authenticated...

x64 Cyclic XOR Encoder

XOR-encrypts shellcode with a random 8-byte key and attaches an x64 decoder stub call/pop + rotating key, similar to classic XOR shellcode runners. !/usr/bin/env python3 -- coding: utf-8 -- """Cyclic XOR encoder with randomized 8-byte key and x64 decoder stub.""" import os from kittysploit import...

Zammad Session Fixation RCE (CVE-2026-102489)

Exploits CVE-2026-102489 in Zammad 6.3.0–6.5.4: session fixation allows hijacking an authenticated session and achieving remote code execution as the zammad service user via admin scheduler/trigger APIs. Chain with CVE-2026-102490 for root privilege escalation. !/usr/bin/env python3 -- coding:...