VMware vCenter VSAN RCE (CVE-2021-21985)

Exploits CVE-2021-21985 in VMware vCenter: unauthenticated RCE via the VSAN Health Check plugin JSON API Virtual SAN Health Check. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter VSAN Health Check RCE CVE-2021-21985.""" import re from kittysploit import from...

Log4Shell RCE (CVE-2021-44228)

Exploits CVE-2021-44228 Log4j JNDI lookup injection via HTTP headers and query parameters. Uses sleep-based confirmation then delivers the configured reverse CMD payload through a user-supplied LDAP callback URL. !/usr/bin/env python3 -- coding: utf-8 -- """Log4Shell JNDI injection RCE...

Windows Print Spooler RCE (PrintNightmare CVE-2021-34527)

Exploits CVE-2021-34527 PrintNightmare: abuses MS-RPRN RpcAddPrinterDriverEx to register a remote printer driver pointing at an attacker-controlled UNC DLL, executing code as SYSTEM when the Print Spooler service processes the install. !/usr/bin/env python3 -- coding: utf-8 -- """Windows Print...

Honeywell PM43 Printer RCE (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 printers: newline injection in the username field of loadfile.lp login executes OS commands. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell PM43 loadfile command injection CVE-2023-3710.""" import re from kittysploit import from...

SonicWall SMA1000 WorkPlace SSRF (CVE-2026-83548)

Exploits CVE-2026-83548 in SonicWall SMA1000 WorkPlace: unauthenticated absolute-form OPTIONS requests are forwarded to loopback CouchDB, enabling internal database access and downstream RCE chains. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall SMA1000 WorkPlace SSRF to CouchDB...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

SharePoint ToolShell RCE (CVE-2025-53770)

Exploits the SharePoint ToolShell chain: Referer bypass to reach ToolPane.aspx CVE-2025-53771 then unsafe ViewState deserialization for unauthenticated RCE CVE-2025-53770 on on-premises SharePoint. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolShell unauthenticated RCE CVE-2025-5377...

SharePoint ToolPane Register Injection RCE (CVE-2026-65660)

Exploits CVE-2026-65660 in Microsoft SharePoint: unescaped quotes in MSOTlPnDWP Register directive reconstruction allow injecting additional directives and XamlServices.Parse gadget chains via AddGallery/ToolPane endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolPane Register...

DFSCoerce NTLM Coercion

Coerces a Windows target to authenticate to an attacker listener via NetrDfsRemoveStdRoot over the netdfs named pipe DFSCoerce. Use with SMB/HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """DFSCoerce NTLM coercion via NetrDfsRemoveStdRoot MS-DFSNM.""" from kittysploit import fro...

ASUS GT-AC2900 Auth Bypass (CVE-2021-32030)

Exploits CVE-2021-32030 in ASUS GT-AC2900: asustoken null-byte cookie with asusrouter User-Agent grants unauthenticated admin API access. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS GT-AC2900 null-byte auth bypass CVE-2021-32030.""" import json from kittysploit import from...

CirCarLife Auth Bypass (CVE-2018-16670)

Exploits CVE-2018-16670 in CirCarLife 4.3: unauthenticated access to /html/devstat.html and /services/user/values.xml exposes PLC status data. !/usr/bin/env python3 -- coding: utf-8 -- """CirCarLife devstat auth bypass CVE-2018-16670.""" from kittysploit import from lib.protocols.http.httpclient...

Fieldgate SWG70 LFI (CVE-2018-16059)

Exploits CVE-2018-16059 in WirelessHART Fieldgate SWG70 3.0: path traversal via fcgi-bin/wgsetcgi filename parameter reads /etc/passwd and other files. !/usr/bin/env python3 -- coding: utf-8 -- """Endress+Hauser Fieldgate SWG70 LFI CVE-2018-16059.""" import re from kittysploit import from...

GL.iNET Wi-Fi Key Disclosure (CVE-2023-31478)

Exploits CVE-2023-31478 in GL.iNet routers 3.216: unauthenticated POST to /api/router/mesh/status leaks SSID and Wi-Fi encryption key. !/usr/bin/env python3 -- coding: utf-8 -- """GL.iNET mesh status Wi-Fi key disclosure CVE-2023-31478.""" from kittysploit import from lib.protocols.http.httpclien...

Fortinet FortiWeb Fabric Connector SQLi (CVE-2025-25257)

Exploits CVE-2025-25257 pre-auth SQL injection in FortiWeb Fabric Connector /api/fabric/device/status via a crafted Authorization Bearer token, then attempts OS command execution through stacked SQL payloads WatchTowr chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb Fabric...

NETGEAR Router cgi-bin RCE (CVE-2016-6277)

Exploits CVE-2016-6277 in multiple NETGEAR routers: shell metacharacters in the cgi-bin path segment yield unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR router cgi-bin path command injection CVE-2016-6277.""" import re from kittysploit import from...

Seagate NAS OS Info Disclosure (CVE-2018-12296)

Exploits CVE-2018-12296 in Seagate NAS OS 4.3.15.1: unauthenticated POST to system.System.getinfos returns firmware version and serial number. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS getinfos disclosure CVE-2018-12296.""" from kittysploit import from...

Telesquare TLR-2005KSH RCE (CVE-2024-29269)

Exploits CVE-2024-29269 in Telesquare TLR-2005KSH LTE routers: unauthenticated command injection via Cmd parameter in sysCommand. !/usr/bin/env python3 -- coding: utf-8 -- """Telesquare TLR-2005KSH command injection CVE-2024-29269.""" import re import urllib.parse from kittysploit import from...

Citrix NetScaler SAML RCE Chain (CVE-2023-3519)

Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. Confirms /saml/login processing, then attempts CVE-2019-19781 template injection as a fallback when directory traversal is available on the same appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler SA...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

GeoServer Jiffle WPS RCE (CVE-2022-24816)

Exploits CVE-2022-24816 in GeoServer via WPS ras:Jiffle: malicious Jiffle script is compiled through Janino into Java for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer Jiffle/Janino WPS RCE CVE-2022-24816.""" import re from kittysploit import from...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

Juniper J-Web PHPRC RCE (CVE-2023-36845)

Exploits CVE-2023-36845 in Juniper Junos J-Web: PHP environment variable modification via /?PHPRC=/dev/fd/0 enables autoprependfile code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Juniper J-Web PHPRC RCE CVE-2023-36845.""" import re from kittysploit import from...

OpenAM Pre-Auth Deserialization RCE (CVE-2026-33439)

Exploits CVE-2026-33439 in OpenAM = 16.0.5: unsafe Java deserialization of jato.clientSession on password reset endpoints bypasses the WhitelistObjectInputStream mitigation applied to jato.pageSession. !/usr/bin/env python3 -- coding: utf-8 -- """OpenAM jato.clientSession deserialization RCE...

Yealink DM Command Injection RCE (CVE-2021-27561)

Exploits CVE-2021-27561 in Yealink Device Management 3.6.0.20: unauthenticated command injection via /sm/api/v1/firewall/zone/services zone parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink DM firewall zone command injection CVE-2021-27561.""" import re import urllib.parse from...

Certifried AD CS Machine Certificate Spoofing (CVE-2022-26923)

Exploits CVE-2022-26923: creates a machine account, clears its SPN, sets dNSHostName to match a domain controller, then enrolls an AD CS Machine template certificate via NTLM web enrollment. The resulting certificate may authenticate as the spoofed DC via PKINIT. !/usr/bin/env python3 -- coding:...

Microsoft IIS HTTP.sys Range RCE (CVE-2015-1635)

Exploits CVE-2015-1635 MS15-034 in HTTP.sys on IIS 8.x: crafted Range headers trigger integer overflow enabling remote code execution or DoS. This module verifies the vulnerable code path and sends the canonical overlapping-range trigger used by public PoCs. !/usr/bin/env python3 -- coding: utf-8...

noPac CVE-2021-42278/42287 Detect

Detects prerequisites for the noPac SamAccountName spoofing chain: authenticated LDAP access, ms-DS-MachineAccountQuota 0, and at least one domain controller computer object. Does not verify patch level. !/usr/bin/env python3 -- coding: utf-8 -- """Detect noPac CVE-2021-42278/42287 prerequisite...

PetitPotam NTLM Coercion

Coerces a Windows target to authenticate to an attacker-controlled listener via the EfsRpcOpenFileRaw API PetitPotam / CVE-2021-36942. Use with an SMB or HTTP relay listener to capture NTLM hashes or relay. !/usr/bin/env python3 -- coding: utf-8 -- """PetitPotam NTLM coercion via EfsRpcOpenFileRa...

Dahua RPC Login Auth Bypass (CVE-2021-33044)

Exploits CVE-2021-33044 and CVE-2021-33045 in Dahua IPC/VTH/VTO: crafted global.login RPC requests bypass authentication and return a valid session. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua RPC login auth bypass CVE-2021-33044 / CVE-2021-33045.""" import json from kittysploit import fro...

D-Link DAP-1620 LFI (CVE-2021-46381)

Exploits CVE-2021-46381 in D-Link DAP-1620: path traversal via htmlresponsepage in POST /apply.cgi reads /etc/passwd and /etc/shadow without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-1620 apply.cgi traversal LFI CVE-2021-46381.""" import re from kittysploit import fr...

FortiWeb Reflected XSS (CVE-2021-22122)

Exploits CVE-2021-22122 in FortiWeb 6.2/6.3: unauthenticated reflected XSS via error3 and omnisuccess API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """FortiWeb reflected XSS CVE-2021-22122.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TP-Link Router LFI (CVE-2015-3035)

Exploits CVE-2015-3035 in TP-Link Archer/TL-WR routers: path traversal via /login/../../../ reads arbitrary local files including password stores. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer local file inclusion CVE-2015-3035.""" import re from kittysploit import from...

TVT NVMS-1000 Path Traversal (CVE-2019-20085)

Exploits CVE-2019-20085 in TVT NVMS-1000: GET /..%2F traversal reads arbitrary files from the DVR/NVR host. !/usr/bin/env python3 -- coding: utf-8 -- """TVT NVMS-1000 path traversal LFI CVE-2019-20085.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WyreStorm Apollo VX20 Config Leak (CVE-2024-25735)

Exploits CVE-2024-25735 in WyreStorm Apollo VX20 1.3.58: unauthenticated GET /device/config exposes SoftAP router credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """WyreStorm Apollo VX20 config leak CVE-2024-25735.""" from kittysploit import from lib.protocols.http.httpclient impor...

Zeroshell kerbynet RCE (CVE-2020-29390)

Exploits CVE-2020-29390 in Zeroshell 3.9.3: shell metacharacter injection via ampersand-wrapped commands in StartSessionSubmit User parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet ampersand injection CVE-2020-29390.""" import re import urllib.parse from kittysploit impo...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

Ivanti Endpoint Manager Auth Bypass (CVE-2026-1603)

Exploits CVE-2026-1603 in Ivanti Endpoint Manager 2024 SU5: unauthenticated POST to /RemoteControlAuth/api/Auth with logintype 64 leaks session identifiers and stored credential metadata. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint Manager auth bypass CVE-2026-1603.""" import jso...

Langflow Broken Access Control (CVE-2026-21445)

Exploits CVE-2026-21445 in Langflow 1.7.0.dev45: unauthenticated access to /api/v1/monitor/messages and related monitor endpoints exposes user conversation data and allows destructive operations without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """Langflow broken access control on...

GitHub Enterprise Server CVE-2026-3854 Detection

Detects GitHub Enterprise Server instances potentially vulnerable to CVE-2026-3854 push option header injection leading to RCE. Checks GHES fingerprint and git push option endpoint behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect GitHub Enterprise Server push-option RCE surface...

SharePoint ToolShell CVE-2025-53770 Detection

Detects on-premises Microsoft SharePoint ToolShell exposure: unauthenticated access to ToolPane.aspx via Referer bypass CVE-2025-53771 and unsafe deserialization surface CVE-2025-53770. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SharePoint ToolShell auth bypass CVE-2025-53771 and ToolPan...

Citrix NetScaler Pre-Auth Command Injection (CVE-2026-88771)

Exploits CVE-2026-88771 in Citrix NetScaler ADC/Gateway: attacker-controlled login values are logged and later interpolated into nsmonuploadderr.pl shell commands, yielding root command execution. Sends the pitboss/PPE log-poisoning payload via /nf/auth/doAuthentication.do watchTowr pattern...

FortiMail Path Traversal RCE (CVE-2026-102490)

Exploits CVE-2026-102490 in FortiMail: unauthenticated path traversal and NULL-byte mishandling allows writing arbitrary files, enabling webshell deployment and remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """FortiMail unauthenticated path traversal RCE CVE-2026-102490.""" fro...

FortiOS SSL VPN Credential Leak (CVE-2018-13379)

Exploits CVE-2018-13379 path traversal in FortiOS/FortiProxy SSL VPN web portal to download /dev/cmdb/sslvpnwebsession and extract active session credentials. !/usr/bin/env python3 -- coding: utf-8 -- """FortiOS SSL VPN session credential leak CVE-2018-13379.""" import re from kittysploit import...

JFrog Artifactory Join-Key Admin RCE (CVE-2026-82329)

Exploits CVE-2026-82329 in JFrog Artifactory: default blank cluster join key allows forging an HS256 JWT and obtaining admin access via POST /access/api/v1/registry/join, then executes commands through the system API. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory blank join-key...

WinRAR Path Traversal (CVE-2025-8088)

Generates a malicious RAR archive exploiting CVE-2025-8088 path traversal in WinRAR = 7.11. When extracted, payload is written to the Windows Startup folder for code execution on next login. User interaction required. !/usr/bin/env python3 -- coding: utf-8 -- """WinRAR path traversal code executi...

ManageEngine ServiceDesk RCE (CVE-2021-44077)

Exploits CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus: unauthenticated zip upload to /RestAPI/ImportTechnicians achieves path traversal and RCE. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus ImportTechnicians RCE CVE-2021-44077.""" import io import zipfile fro...

SAP NetWeaver Metadata Uploader RCE (CVE-2025-31324)

Exploits CVE-2025-31324 unauthenticated file upload via SAP NetWeaver Visual Composer Metadata Uploader to deploy a JSP webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer Metadata Uploader RCE CVE-2025-31324.""" import re import...

CKAN DataStore SQL Injection (CVE-2026-42031)

Exploits CVE-2026-42031 unauthenticated SQL injection in CKAN datastoresearchsql API via PostgreSQL tsrewrite primitives. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN datastoresearchsql unauth SQLi CVE-2026-42031.""" import json import urllib.parse from kittysploit import from...

Jenkins Stapler Groovy RCE (CVE-2018-1000861)

Exploits CVE-2018-1000861 in Jenkins =2.153 / LTS =2.138.3: ACL bypass on descriptorByName endpoints allows Groovy execution via checkScriptCompile. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins Stapler ACL bypass Groovy RCE CVE-2018-1000861.""" import re import urllib.parse from kittysplo...