Linksys E2000 Auth Bypass (CVE-2024-27497)

Exploits CVE-2024-27497 in Linksys E2000 1.0.06: unauthenticated access to /position.js leaks sessionkey and admin interface paths. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E2000 position.js auth bypass CVE-2024-27497.""" from kittysploit import from lib.protocols.http.httpclient impo...

HPE iLO4 Authentication Bypass (CVE-2017-12542)

Exploits CVE-2017-12542 in HPE Integrated Lights-Out 4 before 2.53: unauthenticated REST access to /rest/v1/AccountService/Accounts and related APIs. !/usr/bin/env python3 -- coding: utf-8 -- """HPE iLO4 authentication bypass CVE-2017-12542.""" import json from kittysploit import from...

Razer Sila Router LFI (CVE-2022-29014)

Exploits CVE-2022-29014 in Razer Sila 2.0.418: unauthenticated ubus JSON-RPC file.read on /ubus/ allows reading arbitrary files such as /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Razer Sila ubus file read LFI CVE-2022-29014.""" import json import re from kittysploit import from...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

TeamCity Auth Bypass Admin Creation (CVE-2024-27198)

Exploits CVE-2024-27198 in JetBrains TeamCity: alternate servlet path /hax?jsp=/app/rest/... bypasses authentication to create an administrator account via the REST users API. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity authentication bypass admin creation CVE-2024-27198."""...

TeamCity Path Traversal Auth Bypass (CVE-2024-27199)

Exploits CVE-2024-27199 in JetBrains TeamCity: path traversal to /admin/diagnostic.jsp exposes debug logging and limited admin actions without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity path traversal auth bypass CVE-2024-27199.""" from kittysploit import from...

nf_tables catch-all UAF LPE (CVE-2026-23111)

Local privilege escalation via CVE-2026-23111: nftables nftmapcatchallactivate abort-path use-after-free. Uploads and executes exploit binary on the target session to obtain root. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via nftables catch-all UAF CVE-2026-23111.""" import os import...

nf_tables Double-Free LPE (CVE-2024-1086)

Local privilege escalation via CVE-2024-1086: nftables nftverdictinit accepts NFDROP with positive errno, causing skb double-free in nfhookslow. Uploads and executes a compiled exploit on the target session requires unprivileged user namespaces and nftables on the victim. !/usr/bin/env python3 --...

D-Link Router Sip Parameter RCE (CVE-2018-10823)

Exploits CVE-2018-10823 in D-Link DWR routers: command injection via the Sip parameter on chkisg.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link router chkisg.htm command injection CVE-2018-10823.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

Palo Alto GlobalProtect Command Injection (CVE-2024-3400)

Exploits CVE-2024-3400 in PAN-OS GlobalProtect: SESSID path traversal writes into devicetelemetry cron directories, yielding root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect PAN-OS command injection CVE-2024-3400.""" import secrets import time from...

Sophos Firewall Auth Bypass RCE (CVE-2022-1040)

Exploits CVE-2022-1040 in Sophos Firewall =18.5 MR3: authentication bypass in User Portal /userportal/Controller enables pre-auth Java deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall userportal auth bypass RCE CVE-2022-1040.""" import re from kittysploit import...

Tenda AC1200 Auth Bypass (CVE-2022-40843)

Exploits CVE-2022-40843 in Tenda AC1200 V-W15Ev2: empty W15Ev2user cookie bypasses authentication and exposes syslog/config containing admin password hash. !/usr/bin/env python3 -- coding: utf-8 -- """Tenda AC1200 session auth bypass CVE-2022-40843.""" import re from kittysploit import from...

Apache Struts2 S2-053 OGNL RCE (CVE-2017-12611)

Exploits CVE-2017-12611 S2-053 in Apache Struts 2 via Freemarker tag OGNL injection in the name parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-053 Freemarker OGNL RCE CVE-2017-12611.""" import re import urllib.parse from kittysploit import from...

Citrix NetScaler SAML RCE Chain (CVE-2023-3519)

Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. Confirms /saml/login processing, then attempts CVE-2019-19781 template injection as a fallback when directory traversal is available on the same appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler SA...

Ivanti CSA Auth Bypass (CVE-2024-8963)

Exploits CVE-2024-8963 in Ivanti Cloud Services Appliance 4.6 Patch 519: path traversal via index.php%3F.php/gsb/users.php exposes admin user management. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti CSA path traversal auth bypass CVE-2024-8963.""" from kittysploit import from...

vBulletin widget_php RCE (CVE-2019-16759)

Exploits CVE-2019-16759 in vBulletin 5.0.0–5.5.4 via unauthenticated ajax/render/widgettabbedcontainertabpanel widgetphp template injection. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin widgetphp RCE CVE-2019-16759.""" import hashlib import re import urllib.parse from kittysploit import...

Intelbras Switch Config Leak (CVE-2023-36144)

Exploits CVE-2023-36144 in Intelbras SG 2404 MR: unauthenticated GET to /cgi-bin/exportCfgwithpasswd downloads full device backup with credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Intelbras Switch config export leak CVE-2023-36144.""" from kittysploit import from...

Kyocera Printer LFI (CVE-2020-23575)

Exploits CVE-2020-23575 in Kyocera d-COPIA253MF: null-byte directory traversal via /wlmeng/ reads /etc/passwd and other local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer wlmeng traversal LFI CVE-2020-23575.""" import re from kittysploit import from...

N-able N-central Pre-Auth RCE (CVE-2026-86218)

Exploits CVE-2026-86218 in N-able N-central builds before 2026.3.1.14: pre-authentication static code injection via /remoteControlAction.do getPierDetails allows arbitrary Java code execution on the N-central server. !/usr/bin/env python3 -- coding: utf-8 -- """N-able N-central pre-auth static co...

MajorDoMo Admin Console RCE (CVE-2026-27174)

Exploits CVE-2026-27174 in MajorDoMo: unauthenticated access to the admin PHP console via /admin.php?ajaxpanel=1&op=console&command= allows arbitrary PHP/code execution. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo unauthenticated admin console PHP execution CVE-2026-27174.""" import re...

Zammad Session Fixation RCE (CVE-2026-102489)

Exploits CVE-2026-102489 in Zammad 6.3.0–6.5.4: session fixation allows hijacking an authenticated session and achieving remote code execution as the zammad service user via admin scheduler/trigger APIs. Chain with CVE-2026-102490 for root privilege escalation. !/usr/bin/env python3 -- coding:...

WP Download Manager Shortcode RCE (CVE-2024-11740)

Exploits CVE-2024-11740 in WordPress Download Manager 3.3.04: unauthenticated arbitrary shortcode execution via wpdmxp query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Download Manager shortcode execution CVE-2024-11740.""" from kittysploit import from...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

FortiMail Path Traversal RCE (CVE-2026-102490)

Exploits CVE-2026-102490 in FortiMail: unauthenticated path traversal and NULL-byte mishandling allows writing arbitrary files, enabling webshell deployment and remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """FortiMail unauthenticated path traversal RCE CVE-2026-102490.""" fro...

Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)

Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...

ptrace Credential Steal LPE (CVE-2026-4633)

Local privilege escalation via CVE-2026-4633: ptracemayaccess / pidfdget credential-steal primitive. Compiles and uploads exploit to the target session to obtain root. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via ptrace credential steal CVE-2026-4633.""" import os import shlex impor...

XWiki SolrSearch Groovy RCE (CVE-2025-24893)

Exploits CVE-2025-24893 in XWiki Platform: unauthenticated Groovy execution via crafted text parameter on /bin/get/Main/SolrSearch. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki SolrSearch Groovy RCE CVE-2025-24893.""" import re import urllib.parse from kittysploit import from...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

Drupal Drupalgeddon2 RCE (CVE-2018-7600)

Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...

Ivanti EPMM Authentication Bypass (CVE-2023-35078)

Exploits CVE-2023-35078 in Ivanti Endpoint Manager Mobile EPMM: unauthenticated access to /mifs/aad/api/v2/admins/users allows reading admin accounts and creating a new local administrator. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM unauthenticated admin API access CVE-2023-35078.""...

Zyxel NBG2105 Auth Bypass (CVE-2021-3297)

Exploits CVE-2021-3297 in Zyxel NBG2105: Cookie login=1 grants administrator access to status and configuration pages without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NBG2105 cookie auth bypass CVE-2021-3297.""" from kittysploit import from lib.protocols.http.httpclient...

Zyxel NAS zylog RCE (CVE-2023-27992)

Exploits CVE-2023-27992 in Zyxel NAS: pre-auth command injection via configuremailsyslog after auth-bypass path /cmd,/ck6fup6/zylogmain/. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS zylog pre-auth command injection CVE-2023-27992.""" import re import urllib.parse from kittysploit impor...

QNAP Photo Station File Read (CVE-2019-7192)

Exploits CVE-2019-7192 in QNAP Photo Station: album/slideshow workflow plus filename traversal in /p/api/video.php reads arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station path traversal file read CVE-2019-7192.""" import re from kittysploit import from...

Hikvision Auth Bypass (CVE-2017-7921)

Exploits CVE-2017-7921 in multiple Hikvision cameras/NVRs: forged auth parameter grants access to deviceInfo and configuration download endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision auth bypass and config leak CVE-2017-7921.""" from kittysploit import from...

React2Shell CVE-2025-55182 Detection

Detects CVE-2025-55182 React2Shell by sending a safe React Flight multipart payload that evaluates 77+1 via the prefix gadget. Positive when the response reflects RSC deserialization behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect React2Shell CVE-2025-55182 on Next.js / React Serve...

NVIDIA Triton Inference Server Auth Bypass (CVE-2026-24207)

Exploits CVE-2026-24207 in NVIDIA Triton Inference Server = 26.02: unauthenticated access to restricted HTTP APIs including /models and model management endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """NVIDIA Triton Inference Server auth bypass CVE-2026-24207.""" import json from kittysplo...

DrayTek Router RCE (CVE-2020-8515)

Exploits CVE-2020-8515 in DrayTek Vigor routers: unauthenticated command injection via keyPath in /cgi-bin/mainfunction.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek mainfunction.cgi command injection CVE-2020-8515.""" import re from kittysploit import from lib.protocols.http.httpclie...

Yachtcontrol systemcall RCE (CVE-2019-17270)

Exploits CVE-2019-17270 in Yachtcontrol webapplication 1.0: unauthenticated OS command injection via /pages/systemcall.php?command=. !/usr/bin/env python3 -- coding: utf-8 -- """Yachtcontrol systemcall.php command injection CVE-2019-17270.""" import re import urllib.parse from kittysploit import...

Citrix ShareFile File Read (CVE-2020-8982)

Exploits CVE-2020-8982 in Citrix ShareFile StorageZones str: depth = r'\..\' 8 target = re...

Check Point Management Path Traversal RCE (CVE-2026-93616)

Exploits CVE-2026-93616 on Check Point Quantum Security Management: pre-authentication path traversal on TCP/19009 allows writing attacker-controlled content to reachable paths, enabling remote code execution on the SMS/Gaia host. !/usr/bin/env python3 -- coding: utf-8 -- """Check Point Quantum...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

Zyxel GS1900 CGI Stack Overflow RCE (CVE-2026-7273)

Exploits CVE-2026-7273 pre-authentication stack-based buffer overflow in Zyxel GS1900 smart-managed switch CGI handlers. Sends an oversized HTTP POST to /cgi-bin/dispatcher.cgi and alternate CGI endpoints to trigger memory corruption and attempt command execution. Firmware = 2.90XXXX.1C0 is...

NTLM Coercion Multi-Method

Attempts multiple NTLM coercion primitives against a Windows target: PetitPotam EfsRpcOpenFileRaw and DFSCoerce NetrDfsRemoveStdRoot. Use with SMB or HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """Multi-method NTLM coercion PetitPotam + DFSCoerce.""" from kittysploit import fr...

Buffalo WSR Auth Bypass (CVE-2021-20090)

Exploits CVE-2021-20090 in Buffalo WSR-2533 and Arcadyan-based routers: /images/..%2f traversal bypasses authentication and exposes admin info.html. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo/Arcadyan path traversal auth bypass CVE-2021-20090.""" from kittysploit import from...

Cisco RV320 Config Leak (CVE-2019-1653)

Exploits CVE-2019-1653 in Cisco RV320/RV325: unauthenticated GET to /cgi-bin/config.exp downloads the full router configuration including credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320/RV325 config disclosure CVE-2019-1653.""" from kittysploit import from...

D-Link NAS Backdoor RCE (CVE-2024-3272)

Exploits CVE-2024-3272 in D-Link DNS-320L/325/327L/340L: hard-coded messagebus account in nassharing.cgi cmd=15 runs base64-encoded shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link NAS messagebus backdoor RCE CVE-2024-3272.""" import base64 import re from kittysploit import fro...

NETGEAR Debug Auth Bypass (CVE-2020-27866)

Exploits CVE-2020-27866 on multiple NETGEAR routers: unauthenticated access to /setup.cgi?todo=debug exposes debug mode and configuration pages. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR password recovery auth bypass CVE-2020-27866.""" from kittysploit import from...

Netis Router Info Disclosure (CVE-2024-48455)

Exploits CVE-2024-48455 in Netis WiFi routers: unauthenticated POST to skkget.cgi with modename/wllink leaks device stats and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Netis router skkget.cgi info disclosure CVE-2024-48455.""" from kittysploit import from...

Arista VeloCloud Orchestrator Auth Bypass (CVE-2026-93952)

Targets CVE-2026-93952 in on-prem VeloCloud Orchestrator VCO: when certificate-based Edge authentication is enabled, forged/absent cert checks may allow unauthenticated access to privileged portal and REST APIs. Probes internal API routes after portal fingerprinting. !/usr/bin/env python3 --...