GeoServer Jiffle WPS RCE (CVE-2022-24816)

Exploits CVE-2022-24816 in GeoServer via WPS ras:Jiffle: malicious Jiffle script is compiled through Janino into Java for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer Jiffle/Janino WPS RCE CVE-2022-24816.""" import re from kittysploit import from...

Primefaces EL Injection RCE (CVE-2017-1000486)

Exploits CVE-2017-1000486 in Primefaces 5.x: weak AES passphrase allows forging pfdrid payloads that evaluate Java EL expressions for RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Primefaces weak encryption EL injection RCE CVE-2017-1000486.""" import base64 import re from hashlib import md5...

Cisco IOS SNMP RCE (CVE-2025-20352)

Exploits CVE-2025-20352 stack-based buffer overflow in Cisco IOS/IOS-XE SNMP subsystem. Sends crafted SNMP SET/GET packets to trigger overflow and execute shellcode or crash for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS/IOS-XE SNMP stack overflow RCE CVE-2025-20352."""...

bad_epoll UAF LPE (CVE-2026-46242)

Local privilege escalation via CVE-2026-46242 epoll use-after-free. Compiles and uploads exploit to target session for root shell. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via epoll UAF CVE-2026-46242.""" import os import shlex import tempfile from kittysploit import from...

Kibana Console Path Traversal LFI (CVE-2018-17246)

Exploits CVE-2018-17246 in Kibana 6.4.3 / 5.6.13: path traversal in /api/console/apiserver apis parameter reads arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Console plugin path traversal LFI CVE-2018-17246.""" import re from kittysploit import from...

phpVMS Legacy Importer Auth Bypass (CVE-2026-42569)

Exploits CVE-2026-42569 in phpVMS 7.0.6: unauthenticated access to the legacy /importer feature exposes database configuration and import controls. !/usr/bin/env python3 -- coding: utf-8 -- """phpVMS legacy importer auth bypass CVE-2026-42569.""" from kittysploit import from...

ptrace Credential Steal LPE (CVE-2026-4633)

Local privilege escalation via CVE-2026-4633: ptracemayaccess / pidfdget credential-steal primitive. Compiles and uploads exploit to the target session to obtain root. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via ptrace credential steal CVE-2026-4633.""" import os import shlex impor...

MajorDoMo Admin Console RCE (CVE-2026-27174)

Exploits CVE-2026-27174 in MajorDoMo: unauthenticated access to the admin PHP console via /admin.php?ajaxpanel=1&op=console&command= allows arbitrary PHP/code execution. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo unauthenticated admin console PHP execution CVE-2026-27174.""" import re...

React2Shell CVE-2025-55182 Detection

Detects CVE-2025-55182 React2Shell by sending a safe React Flight multipart payload that evaluates 77+1 via the prefix gadget. Positive when the response reflects RSC deserialization behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect React2Shell CVE-2025-55182 on Next.js / React Serve...

Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)

Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...

Cisco SD-WAN CVE-2026-76504 Detect

Detects CVE-2026-76504 on Cisco Catalyst SD-WAN Manager vManage: percent-encoded jsecuritycheck path bypasses authentication rules and returns an admin-level session cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco Catalyst SD-WAN Manager CVE-2026-76504 auth bypass surface.""" fr...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

Microsoft IIS HTTP.sys Range RCE (CVE-2015-1635)

Exploits CVE-2015-1635 MS15-034 in HTTP.sys on IIS 8.x: crafted Range headers trigger integer overflow enabling remote code execution or DoS. This module verifies the vulnerable code path and sends the canonical overlapping-range trigger used by public PoCs. !/usr/bin/env python3 -- coding: utf-8...

GitLab CVE-2026-85706 File Path LFI Detect

Detects CVE-2026-85706 in self-managed GitLab CE/EE before patched releases 17.11.7, 18.0.4, 18.1.2, 18.2.2, 18.3.2, 18.4.0: unauthenticated multipart uploads can supply file.path or metadata.path outside Workhorse temp dirs, leading to arbitrary file read. Sends a benign absolute-path probe only...

Telemetry Buffer (PowerShell)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Network Preflight (Python)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Python", "description": "Probe callback...

Telemetry Buffer (Python)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

WordPress Core CVE-2026-87902 Page Template LFI Detect

Detects CVE-2026-87902 in WordPress Core 4.7.0 through 7.1.1: getpagetemplate decodes pagename without validatefile, enabling unauthenticated local .php inclusion when the active theme exposes a top-level page- directory e.g. page-templates/. Fixed in 7.1.2. !/usr/bin/env python3 -- coding: utf-8...

Check Point CVE-2026-93616 Management Detect

Detects exposure to CVE-2026-93616 on Check Point Quantum Security Management SmartConsole/SMS before R82.20 / JHF takes listed in sk1000171. Fingerprints the management web service on TCP/19009 and reachable HTTPS management panels without sending exploit upload payloads. !/usr/bin/env python3 -...

FreePBX - Unauth SQLi Detection (CVE-2025-57819)

Detects CVE-2025-57819 via error-based SQL injection on /admin/ajax.php brand parameter, Endpoint Manager module. Confirms MySQL XPATH error leaking freepbxuser. Full RCE requires stacked-query cronjobs injection. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX Endpoint Manager unauth SQLi...

DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...

Monitorix Pipe RCE (CVE-2013-7070)

Exploits CVE-2013-7070/7071 by injecting commands into pipe-wrapped Monitorix URL paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix pipe path command injection RCE CVE-2013-7070 — execute session.""" from future import annotations import re from...

Apache Druid JavaScript RCE (CVE-2021-25646)

Exploits CVE-2021-25646 by enabling the JavaScript parser through /druid/indexer/v1/sampler and running arbitrary OS commands. Druid 0.20.1; authentication is off by default. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Druid JavaScript sampler RCE...

Honeywell IP Camera - check.cgi File Read

Reads arbitrary files via Honeywell IP camera /check.cgi?file= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP camera check.cgi file parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

Bash Shellshock HTTP CGI RCE (CVE-2014-6271)

Exploits CVE-2014-6271 by injecting :;; into HTTP headers against CGI-enabled paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — execute session.""" from future import annotations import re from kittysploit import...

Apache OFBiz CVE-2023-51467 Auth Bypass Detection

Detects CVE-2023-51467 by accessing /webtools/control/ping with empty credentials and requirePasswordChange=Y, then confirming Groovy execution via ProgramExport. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz CVE-2023-51467 authentication bypass detection.""" import re from kittysploi...

Atlassian Confluence Setup Bypass RCE (CVE-2023-22515)

Exploits CVE-2023-22515 to reset setupComplete, create an administrator account, upload a malicious Confluence plugin servlet, and execute a reverse CMD payload. Affects Confluence 8.0.0–8.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence setup reset + admin creation + plugin...

Apache OFBiz Auth Bypass Groovy RCE (CVE-2023-51467)

Exploits CVE-2023-51467 authentication bypass empty credentials + requirePasswordChange=Y to reach /webtools/control/ProgramExport and run arbitrary Groovy via groovyProgram. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz auth bypass + Groovy RCE...

OpenCPU RCE via do.call

Exploits unauthenticated R code execution on OpenCPU via /ocpu/library/base/R/do.call/json with systempaste.... Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCPU R do.call system RCE — execute session.""" from future import annotations import json import r...

IceWarp WebClient RCE

Exploits unauthenticated PHP code injection in IceWarp WebClient via the dlgcaptchatarget parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient captcha target RCE — execute session.""" from future import annotations import re from...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Multiple CCTV-DVR Vendors

Remote Code Execution in CCTV-DVR affecting over 70 different vendors !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV-DVR Vendors""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Multiple CCTV-D...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

D-Link DIR-850L Creds Disclosure

Module exploits D-Link DIR-850L credentials disclosure vulnerability, which allows retrieving administrative credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-850L Creds Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Cisco IOS HTTP Unauthorized Administrative Access

HTTP server for Cisco IOS 11.3 to 12.2 allows attackers to bypass authentication and execute arbitrary commands, when local authorization is being used, by specifying a high access level in the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS HTTP Unauthorized Administrative Access"""...

D-Link DIR-645 & DIR-815 RCE

Module exploits D-Link DIR-645 and DIR-815 Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-645 & DIR-815 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Belkin Auth Bypass

Module exploits Belkin authentication using MD5 password disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Belkin Auth Bypass',...

D-Link DNS NAS CVE-2024-10914 account_mgr.cgi RCE detect

Detects CVE-2024-10914 in D-Link ShareCenter NAS devices: unauthenticated command injection via /cgi-bin/accountmgr.cgi?cmd=cgiuseradd&name= DNS-320, DNS-320LW, DNS-325, DNS-340L and related EOL models. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2024-10914 — D-Link DNS NAS accountmgr.cgi...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

Honeywell PM43 Command Injection (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 industrial printers before firmware P10.19.050004: newline injection in loadfile.lp Configure runs self.payload as the embedded Linux user. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-3710 — Honeywell PM43 printer unauthenticated command...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

ESVA - learn-msg.cgi RCE Detection (CVE-2012-10046)

Detects CVE-2012-10046 by requesting /cgi-bin/learn-msg.cgi?id=|id; after fingerprinting released.html. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache Tomcat AJP - Ghostcat Detection (CVE-2020-1938)

Detects CVE-2020-1938 Ghostcat by sending a crafted AJP13 FORWARDREQUEST that includes /WEB-INF/web.xml via javax.servlet.include.servletpath. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat AJP Ghostcat file read / include CVE-2020-1938.""" import socket import struct from kittysploit...

FreeSWITCH - /api/system Command Execution (CVE-2018-19911)

Exploits CVE-2018-19911 by passing OS commands to /api/system/?. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreeSWITCH /api/system RCE CVE-2018-19911 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

D-Link DNS-320 - system_mgr.cgi Command Injection (CVE-2020-25506)

Exploits CVE-2020-25506 by injecting OS commands into fntpserver on /cgi-bin/systemmgr.cgi, writing stdout under /cgi-bin/.txt. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320 systemmgr.cgi NTP command injection CVE-2020-25506 — opens execute...

Dahua Devices - webCapsConfig Information Disclosure (CVE-2019-9680)

Multiple Dahua devices and OEMs expose /webcaps/webCapsConfig without authentication, disclosing deviceType and vendor metadata. CVE-2024-13131 was rejected as a duplicate of CVE-2019-9680. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM unauthenticated webCapsConfig information...

VideoIQ Camera - Path Traversal Detection

Detects VideoIQ LFI via /../../etc/passwd style paths. !/usr/bin/env python3 -- coding: utf-8 -- """VideoIQ camera path traversal LFI.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VideoIQ Camera - Path...

Tiki Wiki - flv_stream.php File Download Detection

Detects Tiki Wiki arbitrary file download via /vendor/player/flv/flvstream.php?file=../../../db/local.php. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki flvstream.php arbitrary file download.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Bash Shellshock - HTTP CGI RCE (CVE-2014-6271)

Exploits Shellshock via User-Agent injection against a CGI path. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — opens execute session.""" import re from kittysploit import from lib.protocols.http.httpclient import...