Cacti CVE-2025-24367 graph template RCE

CVE-2025-24367 Cacti = 1.2.28: newline injection in graph template rightaxislabel breaks out of rrdtool arguments and writes PHP to the web root. Authenticated; plants a ?c= webshell and runs the given command. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2025-24367 authenticated...

x64 Cyclic XOR Encoder

XOR-encrypts shellcode with a random 8-byte key and attaches an x64 decoder stub call/pop + rotating key, similar to classic XOR shellcode runners. !/usr/bin/env python3 -- coding: utf-8 -- """Cyclic XOR encoder with randomized 8-byte key and x64 decoder stub.""" import os from kittysploit import...

crawl4ai CVE-2026-91940 detect

Detects crawl4ai HTTP API POST /crawl vulnerable to CVE-2026-91940 untrusted PDFContentScrapingStrategy imagesavedir arbitrary write 0.9.3. !/usr/bin/env python3 -- coding: utf-8 -- """Detect crawl4ai API CVE-2026-91940 exposure.""" from kittysploit import from lib.protocols.http.httpclient impor...

Zammad Session Fixation RCE (CVE-2026-102489)

Exploits CVE-2026-102489 in Zammad 6.3.0–6.5.4: session fixation allows hijacking an authenticated session and achieving remote code execution as the zammad service user via admin scheduler/trigger APIs. Chain with CVE-2026-102490 for root privilege escalation. !/usr/bin/env python3 -- coding:...

Jenkins Stapler Groovy RCE (CVE-2018-1000861)

Exploits CVE-2018-1000861 in Jenkins =2.153 / LTS =2.138.3: ACL bypass on descriptorByName endpoints allows Groovy execution via checkScriptCompile. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins Stapler ACL bypass Groovy RCE CVE-2018-1000861.""" import re import urllib.parse from kittysplo...

NVIDIA Triton Inference Server Auth Bypass (CVE-2026-24207)

Exploits CVE-2026-24207 in NVIDIA Triton Inference Server = 26.02: unauthenticated access to restricted HTTP APIs including /models and model management endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """NVIDIA Triton Inference Server auth bypass CVE-2026-24207.""" import json from kittysplo...

Metabase - H2 Deserialization RCE (CVE-2026-59827)

Exploits CVE-2026-59827 by authenticating to Metabase, locating an H2 database including the default sample DB, and submitting a native query that deserializes a Clojure PriorityQueue gadget chain via SELECT CASTX'...' AS OTHER. Command execution is blind — output is not returned over HTTP...

Apache Solr Velocity Template RCE (CVE-2019-0193)

Exploits CVE-2019-0193 Velocity template injection on /core/select when the VelocityResponseWriter is enabled. Runs OS commands via wt=velocity and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr Velocity template RCE CVE-2019-0193 — execute...

ZTE F460 & F660 Backdoor RCE

Exploits ZTE F460 and F660 backdoor vulnerability that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE F460 & F660 Backdoor RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.exploit.handler...

Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

DirPHP - phpfile LFI Detection (CVE-2014-5115)

Detects CVE-2014-5115 by requesting index.php?phpfile=/etc/passwd on DirPHP. !/usr/bin/env python3 -- coding: utf-8 -- """DirPHP phpfile local file inclusion CVE-2014-5115.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

hybris Commerce - medias context LFI Detection (CVE-2014-8871)

Detects CVE-2014-8871 by requesting /medias/?context= with a base64-encoded master|root|...|../../../../../../etc/passwd| payload. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce context= base64 path traversal CVE-2014-8871.""" import base64 import re from kittysploit import from...

Kitty Agent Installer Pack

Writes kittyagent.py plus installlinux.sh systemd and/or installwindows.ps1 scheduled task. Controller: listeners/multi/reversehttppolling. from kittysploit import from lib.c2.agentinstaller import buildinstallreadme, buildlinuxinstallsh, buildwindowsschtasksinstallps1, from lib.c2.agentspec impo...

GitLab API Token Abuse

Uses leaked glpat- tokens to enumerate GitLab user identity and accessible projects via /api/v4. Auto-discovers tokens from CI YAML and bundles. !/usr/bin/env python3 -- coding: utf-8 -- """Abuse leaked GitLab personal access tokens against GitLab API.""" from kittysploit import from...

ONVIF Client

Discovers an ONVIF device service, loads Media/PTZ/Events capabilities, and creates an interactive ONVIF shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ONVIF bind listener — opens an interactive ONVIF camera session.""" from kittysploit import from lib.protocols.onvif.client import...

NFS Showmount

Queries the MOUNT daemon via portmap for NFS export lists NSE nfs-showmount. !/usr/bin/env python3 -- coding: utf-8 -- """NFS showmount / export list NSE nfs-showmount.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nfs.detectors import...

Umbraco CMS - Directory Listing Exposure Detection

Detected directory listing enabled on sensitive Umbraco CMS directories, potentially exposing configuration files, logs, backups, and other sensitive data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected directory listing enabled on sensitive Umbraco CMS directories, potentially exposing...

FirstPromoter - Detect

Detects FirstPromoter affiliate and referral tracking artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FirstPromoter affiliate and referral tracking artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

FullStory RUM - Detect

Detects FullStory Session Replay & Digital Experience Intelligence artifacts. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FullStory Session Replay & Digital Experience Intelligence artifacts.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Rockwell Automation FactoryTalk ViewPoint - Panel Detection

Rockwell Automation FactoryTalk ViewPoint is a web-based HMI that allows remote monitoring and control of industrial automation systems from a browser. It provides access to FactoryTalk View Machine Edition and Site Edition displays. Exposed instances may allow unauthorised access to industrial...

Springboot Liquidbase API Detection

This liquibase endpoint provides information about database changes !/usr/bin/env python3 -- coding: utf-8 -- """This liquibase endpoint provides information about database changes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

ipTIME Router Login Panel - Detect

ipTIME router login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ipTIME router login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ipTIME Router Login Panel -...

Kube API Version Detection

Searches for exposed Kubernetes API servers which return version information unauthenticated !/usr/bin/env python3 -- coding: utf-8 -- """Searches for exposed Kubernetes API servers which return version information unauthenticated.""" from kittysploit import from lib.protocols.http.httpclient...

Meshery - Detect

Meshery is a open source, cloud native manager that enables the design and management of all Kubernetes-based infrastructure and applications multi-cloud. !/usr/bin/env python3 -- coding: utf-8 -- """Meshery is a open source, cloud native manager that enables the design and management of all...

Libvirt Exporter Metrics Detection

Libvirt Exporter is leaking metrics. !/usr/bin/env python3 -- coding: utf-8 -- """Libvirt Exporter is leaking metrics.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Libvirt Exporter Metrics Detection', 'description...

XiongMai uc-httpd 1.0.0 - Buffer Overflow Detection

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. !/usr/bin/env python3 -- coding: utf-8 -- """Buffer overflow in XiongMai uc-httpd 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier...

Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCE Detection

The plugin does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary files from the hosts file system. This may be escalated to RCE using PHP filter chains. !/usr/bin/env python3 --...

WordPress JNews Theme <8.0.6 - Cross-Site Scripting Detection

WordPress JNews theme before 8.0.6 contains a reflected cross-site scripting vulnerability. It does not sanitize the catid parameter in the POST request /?ajax-request=jnews with action=jnewsbuildmegacategory. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress JNews theme before 8.""" from...

AVTECH Video Surveillance Product - Unauthenticated File Download Detection

AVTECH video surveillance products unauthenticated file download from web root through /cgi-bin/cgibox, Since the .cab string is verified by the strstr method, the file download can be realized by adding ?.cab at the end of the file name. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH video...

Cleo Technology - Detect

This template detects Cleo technologies, including VLTrader, Harmony, and LexiCom, by inspecting response headers.It also extracts version information for each identified technology. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects Cleo technologies, including VLTrader, Harmony,...

Boa Web Server - Detect

Boa is a single-tasking HTTP server. That means that unlike traditional web servers, it does not fork for each incoming connection, nor does it fork many copies of itself to handle multiple connections. !/usr/bin/env python3 -- coding: utf-8 -- """Boa is a single-tasking HTTP server.""" import re...

Brother Printer Panel - Detect

Brother printer web interface and management panel was detected. This template identifies exposed Brother printer panels that may be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Brother printer web interface and management panel was detected.""" from kittysploit...

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure Detection

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink E1 Zoom Camera versions 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Canon Remote UI Login Panel - Detect

Canon Remote UI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Canon Remote UI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Canon Remote UI Login Panel - Detect',...

Saia PCD Web-Server Configuration Page - Detect

Saia PCD Web-Server configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Saia PCD Web-Server configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Saia PCD Web-Serv...

Oracle Internet File System FTP Service - Detect

Oracle Internet File System FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Internet File System FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient:...

Weblate Public Project - Exposure Detection

Weblate instance is publicly accessible. Public exposure of Weblate may lead to unauthorized access to translation projects, potential data leaks, credential exposure, or manipulation of open source localization data. Attackers can view available projects and access sensitive information if prope...

Vagrantfile Exposure Detection

Vagrantfile is exposed to external users. !/usr/bin/env python3 -- coding: utf-8 -- """Vagrantfile is exposed to external users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Vagrantfile Exposure Detection',...

Adobe Coldfusion - Authentication Bypass Detection

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

TOTVS Fluig Platform - Cross-Site Scripting Detection

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input...

JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS Detection

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jpyearbuilt leads to cross...

ProfitTrailer Setup Page - Exposure Detection

Detects exposed ProfitTrailer Setup page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed ProfitTrailer Setup page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ProfitTrailer Setup Page - Exposure...

OpenEMR Setup Installation Page - Exposure Detection

Detects exposed OpenEMR setup installation pages which could allow unauthorized access or information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed OpenEMR setup installation pages which could allow unauthorized access or information disclosu.""" from kittysploit import...

SGLang - Detect

Detects SGLang, a high-performance LLM serving framework that provides an OpenAI-compatible API default port 30000. This template identifies SGLang by checking for the unique /getmodelinfo endpoint returning "modelpath" and "isgeneration" and Prometheus metrics prefixed with "sglang:". An...

Sonarr Dashboard - Unauthenticated Detection

Exposure of Sonarr dashboard which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Sonarr dashboard which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Sucuri Website Firewall - Not Configured Detection

Detects Sucuri Website Firewall - Not Configured. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Sucuri Website Firewall - Not Configured.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sucuri Website Firewall...

SwarmUI Panel - Detect

SwarmUI formerly StableSwarmUI is a modular Stable Diffusion web interface built on ASP.NET Core. It provides a feature-rich UI for AI image generation !/usr/bin/env python3 -- coding: utf-8 -- """SwarmUI formerly StableSwarmUI is a modular Stable Diffusion web interface built on ASP.""" from...

Apache Druid - Local File Inclusion Detection

Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t...

AEM UserInfo Servlet Credentials Exposure Detection

Adobe Experience Manager UserInfoServlet is exposed which allows an attacker to bruteforce credentials. You can get valid usernames from jcr:createdBy, jcr:lastModifiedBy, cq:LastModifiedBy attributes of any JCR node. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe Experience Manager...