Langflow - Broken Access Control Detection

Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. The issue allows any unauthenticated user to access sensitive user conversation data, transaction histories...

Microsoft SharePoint - Site Metadata Disclosure Detection

Detected exposed SharePoint site metadata endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint site metadata endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft...

Web Suite Detect

Detects Web Suite Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Web Suite Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Web Suite Detect', 'description': 'Detects Web Suite Detect.', 'author'...

Unibox Panel - Detect

Unibox Administrator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Unibox Administrator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unibox Panel - Detect', 'description':...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

Apache Kylin - Exposed Configuration File Detection

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha have one REST API which exposed Kylin's configuration information without...

MicroStrategy Web 10.4 - Information Disclosure Detection

MicroStrategy Web 10.4 is susceptible to information disclosure. The JVM configuration, CPU architecture, installation folder, and other information are exposed through /MicroStrategyWS/happyaxis.jsp. An attacker can use this vulnerability to learn more about the application environment and there...

Detect Amazon-S3 Bucket

Detects Detect Amazon-S3 Bucket. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Detect Amazon-S3 Bucket.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Amazon-S3 Bucket', 'description': 'Detec...

Tautulli Panel - Detect

A Python based monitoring and tracking tool for Plex Media Server. !/usr/bin/env python3 -- coding: utf-8 -- """A Python based monitoring and tracking tool for Plex Media Server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Webkul QloApps 1.5.2 - Cross-site Scripting Detection

Cross Site Scripting vulnerability found in Webkil QloApps v.1.5.2 allows a remote attacker to obtain sensitive information via the back and emailcreate parameters in the AuthController.php file. !/usr/bin/env python3 -- coding: utf-8 -- """Cross Site Scripting vulnerability found in Webkil QloAp...

WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing Detection

FastDup WordPress plugin 2.2 contains a directory listing vulnerability caused by lack of access restrictions in sensitive directories, letting attackers view export files, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """FastDup WordPress plugin 2.""" from...

WordPress Hummingbird <= 3.18.0 - Sensitive Information Exposure via Log File Detection

Hummingbird Performance WordPress plugin = 3.18.0 contains a sensitive information exposure caused by improper handling in the 'request' function, letting unauthenticated attackers extract sensitive data including Cloudflare API credentials, exploit requires no authentication. !/usr/bin/env pytho...

Fortinet FortiWeb Login Panel - Detect

Fortinet FortiWeb login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiWeb Login Panel -...

GLPI Status Domain Disclosure Detection

Detects GLPI Status Domain Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects GLPI Status Domain Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GLPI Status Domain Disclosure Detection',...

HP iLO Serial Key - Detect

HP iLO serial key was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HP iLO serial key was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP iLO Serial Key - Detect', 'description': 'HP iLO serial...

ZoneMinder CVE-2026-27470 second-order SQLi

Exploits CVE-2026-27470: authenticated second-order SQL injection in ZoneMinder getNearEvents web/ajax/status.php. Stores a UNION payload in Event Name/Cause parameterized write, then triggers via entity=nearevents. Affected: = 1.36.37 and 1.37.61–1.38.0. Fixed: 1.36.38 / 1.38.1. Requires Events...

Apache Solr CVE-2026-44825 detection

Detects Apache Solr instances in the CVE-2026-44825 affected version range 9.4.x through 9.10.x before 9.10.2, and 10.0.0 and reports whether admin endpoints require authentication. !/usr/bin/env python3 -- coding: utf-8 -- import re from kittysploit import from lib.protocols.http.httpclient impo...

MeiG FORGE_SLT711 CVE-2026-36356 (GoAhead blind OS command injection) detection

Detects unauthenticated blind OS command injection in MeiG Smart FORGESLT711 Ortel 4G LTE CPE and related MDM9607 GoAhead firmware. Fingerprints the web UI, then sends a timed sleep payload to POST /action/SetRemoteAccessCfg. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from...

Windows Get GPP Autologon

Search SYSVOL Registry.xml files for Group Policy Preferences autologon credentials on a Windows shell or Meterpreter session. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.post.windows.session import wincompatfailuretype, winprobepowershell import base64 import re...

HTTP Request Smuggling Scanner

Probes for HTTP request smuggling CL.TE / TE.CL by sending crafted requests that front-end and back-end parse differently. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP Request Smuggling scanner: detects desync between front-end and back-end by sending crafted requests with conflicting...

Wordpress Plugin ACF Frontend Display

Wordpress Plugin ACF Frontend Display = 2.0.6 - Arbitrary File UploadThe ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. from kittysploit import from...

Fortinet FortiNAC keyUpload Cron RCE (CVE-2022-39952)

Horizon3 PoC: unauthenticated POST to /configWizard/keyUpload.jsp with a ZIP placing a cron job under /etc/cron.d/. Use a CMD reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2022-39952 — Fortinet FortiNAC arbitrary file write via keyUpload.jsp Horizon3. Uploads a ZIP whose entr...

osTicket PDF PHP Filter File Read (CVE-2026-22200)

Horizon3: submits an open.php ticket whose rich-text message abuses mPDF list-style-image php://filter chains. Retrieve bytes from the ticket PDF extract BMP / use Horizon3 extractpdfimages.py. No framework session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-22200 — osTicket anonymous...

Synametrics Syncrify 6.2 build 1178 - Path Traversal in the PublicLink Chunk-Upl — Detect

Fingerprint / reachability check for Synametrics Syncrify 6.2 build 1178 - Path Traversal in the PublicLink Chunk-Upload Branch CWE-22 Leading to Root Command Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Synametrics Syncrify 6.2 build 1178 - Path Traversal in the PublicLin...

TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reachi — Detect

Fingerprint / reachability check for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Serv...

VitalPBX — Authenticated Root RCE via asterisk_cli → dialplan System() (Privileg — Detect

Fingerprint / reachability check for VitalPBX — Authenticated Root RCE via asteriskcli → dialplan System Privilege Escalation !/usr/bin/env python3 -- coding: utf-8 -- """Detection for VitalPBX — Authenticated Root RCE via asteriskcli → dialplan System Privilege Escalation""" from kittysploit...

Acumatica customization publish webshell RCE

Customizer-role user imports a ZIP via CustomizationApi/import, publishBegin/End, writes Pages/.aspx to IIS webroot; invoke with ?c= set payload for cmd.exe. """Acumatica authenticated customization import/publish → ASPX webshell RCE.""" from future import annotations import base64 import io impo...

Devolutions Server test-script PAM gate bypass RCE

Administrator login then POST /api/pam/provider-templates/test-script with PamSystemVault GUID in query bypasses entitlement gate and runs PowerShell. """Devolutions Server PAM gate bypass + test-script PowerShell SYSTEM RCE.""" from future import annotations import json import re from kittysploi...

Open eClass RCE (CVE-2024-26503) Detection

Detects GUnet Open eClass 3.15 instances potentially vulnerable to CVE-2024-26503 unrestricted badge icon upload leading to RCE. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from bs4 import BeautifulSoup import re class...

pyLoad CVE-2023-0297 pyimport RCE

CVE-2023-0297 pyLoad-ng 0.5.0b3.dev31: unauthenticated POST /flash/addcrypted2 evaluates the jk form field via js2py without disablepyimport, allowing pyimport os; os.system.... !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad CVE-2023-0297 pre-auth pyimport RCE via /flash/addcrypted2.""" from...

Adminer CVE-2020-35572 arbitrary file read

CVE-2020-35572 Adminer = 4.6.2: server driver makes Adminer connect outbound to attacker MySQL; LOAD DATA LOCAL INFILE pulls target files. !/usr/bin/env python3 -- coding: utf-8 -- """Adminer CVE-2020-35572 rogue-MySQL LOAD DATA LOCAL file read.""" from future import annotations import re from...

Bludit CVE-2019-16113 Detect

Detects Bludit admin login authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Bludit admin login authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Bludit CVE-2019-161...

Wing FTP CVE-2025-47812 Detect

Detects Wing FTP web client authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Wing FTP web client authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Wing FTP...

WordPress 3D FlipBook CVE-2025-58226 sensitive data dump

CVE-2025-58226 ≤ 1.16.16: unauthenticated admin-ajax actions fb3dsendposts and fb3dsendpost expose all flipbook posts including password-protected, metadata, and backing PDF/media URLs. Read-only information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2025-58226 — 3D FlipBook...

PDFMiner CVE-2025-64512 Detect

Heuristic for PDF upload/parse endpoints pdfminer.six CMap RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Heuristic for PDF upload/parse endpoints pdfminer.six CMap RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Valkey/Redis CVE-2026-25243 Detect

Detects Redis-compatible PING on TCP Valkey module RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Redis-compatible PING on TCP Valkey module RCE chain.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner,...

crawl4ai CVE-2026-91940 arbitrary file write

CVE-2026-91940 crawl4ai 0.9.3: POST /crawl with PDFContentScrapingStrategy and attacker-controlled imagesavedir writes extracted image streams to disk. Hosts a minimal PDF on lhost:lport and triggers /crawl. Patched versions return HTTP 400 not permitted. Requires API token on 0.9.2. !/usr/bin/en...

ActiveMQ CVE-2023-46604 Detect

Detects open ActiveMQ OpenWire port ClassPathXmlApplicationContext chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects open ActiveMQ OpenWire port ClassPathXmlApplicationContext chain.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

Joomla DJ-Classifieds CVE-2026-61424 arbitrary upload

CVE-2026-61424 DJ-Classifieds . !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-61424 — Joomla DJ-Classifieds unauthenticated imageupload write.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.joomlaprobe import Joomla class...

Next.js CVE-2024-34351 Server Actions SSRF

CVE-2024-34351 Next.js 13.4.0–14.1.0: Host-header Server Action redirect SSRF. Starts a local relay HEAD text/x-component, GET 302 to internalurl and POSTs with Next-Action to fetch internal content. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js CVE-2024-34351 Server Actions SSRF via...

Apache ActiveMQ CVE-2023-46604 OpenWire RCE

CVE-2023-46604: unauthenticated OpenWire ExceptionResponse deserializes ClassPathXmlApplicationContext pointing at attacker Spring XML with ProcessBuilder. Serves poc.xml on srvhost:srvport and triggers broker on target:openwireport default 61616. !/usr/bin/env python3 -- coding: utf-8 -- """Apac...

XOR Shellcode Runner Evasion

Windows x64 EXE pure Zig: XOR-encrypted embedded shellcode, RW→RX, CreateThread. Compiled with the same Zig pipeline as zigshellevasion. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import compilezigpe, generatepayloadbytes, optionvalue,...

Anuko Time Tracker CVE-2022-24707 puncher SQLi

CVE-2022-24707 Anuko = 1.20.0.5640: authenticated SQLi in puncher.php date parameter writes ttusers credentials into the entry note field. !/usr/bin/env python3 -- coding: utf-8 -- """Anuko Time Tracker CVE-2022-24707 puncher date SQLi credential extract.""" from future import annotations import ...

Magento CVE-2015-1397 Shoplift Detect

Fingerprints Magento and probes CmsWysiwyg/directive/index for SUPEE-5344 missing stacked SQLi sink. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift SQLi surface detect.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Webmin CVE-2019-12840 Detect

Detects Webmin / Usermin login. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Webmin / Usermin login.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Webmin CVE-2019-12840 Detect", "description": "Detects Webm...

Sophos Firewall Auth Bypass RCE (CVE-2022-1040)

Exploits CVE-2022-1040 in Sophos Firewall =18.5 MR3: authentication bypass in User Portal /userportal/Controller enables pre-auth Java deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall userportal auth bypass RCE CVE-2022-1040.""" import re from kittysploit import...

D-Link Router Sip Parameter RCE (CVE-2018-10823)

Exploits CVE-2018-10823 in D-Link DWR routers: command injection via the Sip parameter on chkisg.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link router chkisg.htm command injection CVE-2018-10823.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

UnRaid webGui PHP RCE (CVE-2020-5847)

Exploits CVE-2020-5847 in UnRaid str: php = f'?php echo shellexec"strcmd.replacechr34, chr...

Network Preflight (PowerShell)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight PowerShell", "description": "Probe callback...