Honeywell PM43 Printer RCE (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 printers: newline injection in the username field of loadfile.lp login executes OS commands. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell PM43 loadfile command injection CVE-2023-3710.""" import re from kittysploit import from...

Ivanti EPM CSA Code Injection (CVE-2021-44529)

Exploits CVE-2021-44529 in Ivanti EPM Cloud Services Appliance: crafted cookie values to /client/index.php execute arbitrary PHP code without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPM CSA unauthenticated code injection CVE-2021-44529.""" import base64 import re from...

QNAP Photo Station File Read (CVE-2019-7192)

Exploits CVE-2019-7192 in QNAP Photo Station: album/slideshow workflow plus filename traversal in /p/api/video.php reads arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station path traversal file read CVE-2019-7192.""" import re from kittysploit import from...

TVT NVMS-1000 Path Traversal (CVE-2019-20085)

Exploits CVE-2019-20085 in TVT NVMS-1000: GET /..%2F traversal reads arbitrary files from the DVR/NVR host. !/usr/bin/env python3 -- coding: utf-8 -- """TVT NVMS-1000 path traversal LFI CVE-2019-20085.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zyxel Firewall Auth Bypass (CVE-2022-0342)

Exploits CVE-2022-0342 in Zyxel USG/ZyWALL/ATP/VPN/NSG: unauthenticated export-cgi downloads startup-config.conf with admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel firewall export-cgi auth bypass CVE-2022-0342.""" from kittysploit import from lib.protocols.http.httpclient...

Zyxel NAS remote_help RCE (CVE-2024-29972)

Exploits CVE-2024-29972 in Zyxel NAS326/NAS542: unauthenticated command injection in remotehelp-cgi NsaRescueAngel backdoor path yields root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS remotehelp-cgi command injection CVE-2024-29972.""" import re import urllib.parse...

Arista VeloCloud Orchestrator Auth Bypass (CVE-2026-93952)

Targets CVE-2026-93952 in on-prem VeloCloud Orchestrator VCO: when certificate-based Edge authentication is enabled, forged/absent cert checks may allow unauthenticated access to privileged portal and REST APIs. Probes internal API routes after portal fingerprinting. !/usr/bin/env python3 --...

Check Point Management Path Traversal RCE (CVE-2026-93616)

Exploits CVE-2026-93616 on Check Point Quantum Security Management: pre-authentication path traversal on TCP/19009 allows writing attacker-controlled content to reachable paths, enabling remote code execution on the SMS/Gaia host. !/usr/bin/env python3 -- coding: utf-8 -- """Check Point Quantum...

Citrix NetScaler SAML RCE Chain (CVE-2023-3519)

Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. Confirms /saml/login processing, then attempts CVE-2019-19781 template injection as a fallback when directory traversal is available on the same appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler SA...

SAP NetWeaver Metadata Uploader RCE (CVE-2025-31324)

Exploits CVE-2025-31324 unauthenticated file upload via SAP NetWeaver Visual Composer Metadata Uploader to deploy a JSP webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer Metadata Uploader RCE CVE-2025-31324.""" import re import...

Certifried AD CS Machine Certificate Spoofing (CVE-2022-26923)

Exploits CVE-2022-26923: creates a machine account, clears its SPN, sets dNSHostName to match a domain controller, then enrolls an AD CS Machine template certificate via NTLM web enrollment. The resulting certificate may authenticate as the spoofed DC via PKINIT. !/usr/bin/env python3 -- coding:...

WinRAR Path Traversal (CVE-2025-8088)

Generates a malicious RAR archive exploiting CVE-2025-8088 path traversal in WinRAR = 7.11. When extracted, payload is written to the Windows Startup folder for code execution on next login. User interaction required. !/usr/bin/env python3 -- coding: utf-8 -- """WinRAR path traversal code executi...

SharePoint Trust Endpoint Deserialization RCE (CVE-2026-50522)

Exploits CVE-2026-50522 in on-premises SharePoint: unauthenticated POST to /trust/default.aspx with a crafted wresult/wctx WS-Federation payload triggers unsafe BinaryFormatter deserialization for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint WS-Federation trust...

NTLM Coercion Multi-Method

Attempts multiple NTLM coercion primitives against a Windows target: PetitPotam EfsRpcOpenFileRaw and DFSCoerce NetrDfsRemoveStdRoot. Use with SMB or HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """Multi-method NTLM coercion PetitPotam + DFSCoerce.""" from kittysploit import fr...

Cisco RV320 Config Leak (CVE-2019-1653)

Exploits CVE-2019-1653 in Cisco RV320/RV325: unauthenticated GET to /cgi-bin/config.exp downloads the full router configuration including credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320/RV325 config disclosure CVE-2019-1653.""" from kittysploit import from...

D-Link DIR-868L Credential Leak (CVE-2019-17506)

Exploits CVE-2019-17506 in D-Link DIR-868L/817LW: unauthenticated POST to getcfg.php with AUTHORIZEDGROUP newline injection returns admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-868L getcfg credential leak CVE-2019-17506.""" from kittysploit import from...

D-Link NAS Backdoor RCE (CVE-2024-3272)

Exploits CVE-2024-3272 in D-Link DNS-320L/325/327L/340L: hard-coded messagebus account in nassharing.cgi cmd=15 runs base64-encoded shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link NAS messagebus backdoor RCE CVE-2024-3272.""" import base64 import re from kittysploit import fro...

Zyxel NAS zylog RCE (CVE-2023-27992)

Exploits CVE-2023-27992 in Zyxel NAS: pre-auth command injection via configuremailsyslog after auth-bypass path /cmd,/ck6fup6/zylogmain/. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS zylog pre-auth command injection CVE-2023-27992.""" import re import urllib.parse from kittysploit impor...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...

Citrix NetScaler Pre-Auth Command Injection (CVE-2026-88771)

Exploits CVE-2026-88771 in Citrix NetScaler ADC/Gateway: attacker-controlled login values are logged and later interpolated into nsmonuploadderr.pl shell commands, yielding root command execution. Sends the pitboss/PPE log-poisoning payload via /nf/auth/doAuthentication.do watchTowr pattern...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

GitLab ExifTool DjVu RCE (CVE-2021-22205)

Exploits CVE-2021-22205 in GitLab CE/EE: malformed DjVu metadata embedded in a JPEG upload triggers ExifTool Perl injection during image processing. Delivers a reverse shell via the configured payload or runs verifycmd in-band when possible. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab...

SonicWall SMA1000 WorkPlace SSRF (CVE-2026-83548)

Exploits CVE-2026-83548 in SonicWall SMA1000 WorkPlace: unauthenticated absolute-form OPTIONS requests are forwarded to loopback CouchDB, enabling internal database access and downstream RCE chains. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall SMA1000 WorkPlace SSRF to CouchDB...

Windows Print Spooler RCE (PrintNightmare CVE-2021-34527)

Exploits CVE-2021-34527 PrintNightmare: abuses MS-RPRN RpcAddPrinterDriverEx to register a remote printer driver pointing at an attacker-controlled UNC DLL, executing code as SYSTEM when the Print Spooler service processes the install. !/usr/bin/env python3 -- coding: utf-8 -- """Windows Print...

Aquatronica Controller Credential Leak (CVE-2025-25037)

Exploits CVE-2025-25037 in Aquatronica Controller =5.1.6: unauthenticated POST to tcp.php WSGETNETWORKCFG exposes plaintext WEBPASSWORD. !/usr/bin/env python3 -- coding: utf-8 -- """Aquatronica tcp.php credential leak CVE-2025-25037.""" from kittysploit import from lib.protocols.http.httpclient...

Brother MFC Info Disclosure (CVE-2024-51977)

Exploits CVE-2024-51977 in Brother MFC-L9570CDW: unauthenticated GET to /etc/mntinfo.csv leaks model, firmware, IP, and serial number. !/usr/bin/env python3 -- coding: utf-8 -- """Brother MFC mntinfo disclosure CVE-2024-51977.""" from kittysploit import from lib.protocols.http.httpclient import...

D-Link DAR-8000 Command Injection (CVE-2023-4542)

Exploits CVE-2023-4542 in D-Link DAR-8000-10: OS command injection via the id parameter of /app/sys1.php. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAR-8000 sys1.php command injection CVE-2023-4542.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

D-Link DIR850 Open Redirect (CVE-2021-46379)

Exploits CVE-2021-46379 in D-Link DIR850: unauthenticated open redirect via formWlanRedirect redirect-url parameter phishing / token theft chain. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR850 open redirect CVE-2021-46379.""" import re import urllib.parse from kittysploit import from...

Hikvision Auth Bypass (CVE-2017-7921)

Exploits CVE-2017-7921 in multiple Hikvision cameras/NVRs: forged auth parameter grants access to deviceInfo and configuration download endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision auth bypass and config leak CVE-2017-7921.""" from kittysploit import from...

Intelbras Switch Config Leak (CVE-2023-36144)

Exploits CVE-2023-36144 in Intelbras SG 2404 MR: unauthenticated GET to /cgi-bin/exportCfgwithpasswd downloads full device backup with credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Intelbras Switch config export leak CVE-2023-36144.""" from kittysploit import from...

NETGEAR Router cgi-bin RCE (CVE-2016-6277)

Exploits CVE-2016-6277 in multiple NETGEAR routers: shell metacharacters in the cgi-bin path segment yield unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR router cgi-bin path command injection CVE-2016-6277.""" import re from kittysploit import from...

Cisco Secure FMC Authentication Bypass (CVE-2026-20079)

Exploits CVE-2026-20079 in Cisco Secure Firewall Management Center: crafted CGISESSID=csmprocesses cookie bypasses authentication on CGI endpoints, exposing FMC system information and privileged management surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Firewall FMC boot-time...

Adobe ColdFusion RDS Auth Bypass (CVE-2013-0632)

Exploits CVE-2013-0632 in Adobe ColdFusion: empty adminpassword with rdsPasswordAllowed=1 on administrator.cfc?method=login yields CF admin session. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

MOVEit Transfer SQL Injection RCE (CVE-2023-34362)

Exploits CVE-2023-34362 in Progress MOVEit Transfer: abuses moveitisapi.dll m2 header-smuggling to set guest session variables, then triggers UserGetUsersWithEmailAddress SQL injection via guestaccess.aspx to hijack an admin session or enable xpcmdshell for remote code execution. !/usr/bin/env...

OpenAM Pre-Auth Deserialization RCE (CVE-2026-33439)

Exploits CVE-2026-33439 in OpenAM = 16.0.5: unsafe Java deserialization of jato.clientSession on password reset endpoints bypasses the WhitelistObjectInputStream mitigation applied to jato.pageSession. !/usr/bin/env python3 -- coding: utf-8 -- """OpenAM jato.clientSession deserialization RCE...

Progress LoadMaster Command Injection (CVE-2026-8037)

Exploits CVE-2026-8037 unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 JSON API via malformed g0-g15 fields WatchTowr pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster pre-auth command injection CVE-2026-8037.""" import json import re from...

TeamCity Path Traversal Auth Bypass (CVE-2024-27199)

Exploits CVE-2024-27199 in JetBrains TeamCity: path traversal to /admin/diagnostic.jsp exposes debug logging and limited admin actions without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity path traversal auth bypass CVE-2024-27199.""" from kittysploit import from...

SharePoint ToolShell RCE (CVE-2025-53770)

Exploits the SharePoint ToolShell chain: Referer bypass to reach ToolPane.aspx CVE-2025-53771 then unsafe ViewState deserialization for unauthenticated RCE CVE-2025-53770 on on-premises SharePoint. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolShell unauthenticated RCE CVE-2025-5377...

ForgeRock OpenAM Deserialization RCE (CVE-2021-35464)

Exploits CVE-2021-35464 in ForgeRock OpenAM 7.0: pre-auth Java deserialization via jato.pageSession on /openam/oauth2/..;/ccversion/ path traversal routes. !/usr/bin/env python3 -- coding: utf-8 -- """ForgeRock OpenAM Jato deserialization RCE CVE-2021-35464.""" import re from kittysploit import...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

JFrog Artifactory CVE-2026-42016 Token Escalation

Chains CVE-2026-42018 anonymous JWT acquisition with CVE-2026-42016: POST /access/api/v1/tokens accepts a low-privilege token and returns an admin-scoped token when scope validation checks signature/issuer only. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory CVE-2026-42016 scope...

Netcore NR289-GE CVE-2026-101072 ap_ip.cgi RCE

Exploits CVE-2026-101072 via POST /x.ico/apip.cgi on Netcore NR289-GE AC controllers. The ip form field breaks out of a wget --post-data shell command. Requires a bound AP MAC; payload length is limited to 19 bytes. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NR289-GE CVE-2026-101072...

Fortinet FortiOS CVE-2025-25249 CAPWAP Detect

Detects CVE-2025-25249 exposure by probing UDP/5246 with a benign CAPWAP Discovery Request. A response from cwacd indicates the fabric/CAPWAP control plane is reachable; combine with FortiOS version inventory to assess patch status fixed in 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18 / 6.4.17. !/usr/bin/env...

Kestra <= 1.3.20 / 1.0.44 - /configs Auth Bypass RCE (CVE-2026-49869)

Exploits CVE-2026-49869: Micronaut AuthenticationFilter whitelists any path ending in /configs. Unauthenticated PUT creates a shell workflow, POST triggers execution, logs are polled for command output. Fixed in Kestra 1.0.45 and 1.3.21. !/usr/bin/env python3 -- coding: utf-8 -- """Kestra OSS...

Resource Guard (PowerShell)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard PowerShell", "description": "Exit early whe...

Telemetry Buffer (Zig)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Adobe Campaign Classic CVE-2026-83660 Detect

Detects Adobe Campaign Classic ACC instances likely affected by CVE-2026-83660 unauthenticated SSRF / privilege escalation and CVE-2026-89276 low-privilege code injection. Fingerprints ACC JSP surfaces and parses build numbers from /r/test against the APSB26-142 fixed build 7.4.4.9402...

ConnectWise ScreenConnect CVE-2026-84869 Detect

Detects ScreenConnect server deployments likely serving vulnerable client builds before 26.6.5.9742 CVE-2026-84869: guest file transfer without Host confirmation during active sessions. Parses version markers from Login/Host pages and flags releases below 26.6.5. !/usr/bin/env python3 -- coding:...

Netcore NR289-GE CVE-2026-101076 NTP CGI RCE

Exploits CVE-2026-101076 via POST /x.ico/setntpserverip.cgi on Netcore NR289-GE AC controllers. The ntpip parameter is embedded into a wget shell invocation without sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NR289-GE CVE-2026-101076 setntpserverip.cgi command injection."""...