PaperCut CVE-2026-82078 SQL Primitive Detect

Detects CVE-2026-82078 in PaperCut NG/MF when chained with CVE-2026-81578: attacker-controlled user-lookup SQL templates and JDBC driver settings can be written via unauthenticated Tapestry ConfigEditor direct-service requests. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE

Exploits CVE-2026-9586 via the unauthenticated /pa XML phone-notification endpoint. Injects stacked PostgreSQL into the PhoneIP field and uses COPY ... TO PROGRAM to run a shell command as the database superuser. !/usr/bin/env python3 -- coding: utf-8 -- """Sangoma Switchvox CVE-2026-9586...

WSO2 JWT Auth Bypass Admin Enum (CVE-2026-5430)

Uses CVE-2026-5430 to reach WSO2 admin APIs with a forged alg:none JWT in X-JWT-Assertion. Lists applications and subscription keys when the gateway fails open on unsupported JWT algorithms. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 CVE-2026-5430 JWT alg:none admin API access via...

Cisco Secure Email CVE-2026-76461 Detect

Detects on-prem Cisco Secure Email Gateway AsyncOS appliances exposed to CVE-2026-76461 pre-authentication SQL injection in email parsing. Fingerprints the ESA/IronPort login panel and parses AsyncOS release markers to flag branches before fixed builds 15.5.5-014 / 16.0.4-302 / 16.5.0-780...

F5 BIG-IP CVE-2026-94127 APM OAuth Detect

Detects CVE-2026-94127 exposure when a BIG-IP virtual server combines an APM access policy with an OAuth Authorization Server profile. Probes the OAuth UserInfo endpoint for expected invalidtoken responses and parses BIG-IP version hints from /mgmt/tm/sys/version when reachable. !/usr/bin/env...

SharePoint CVE-2026-65660 ToolPane Detect

Detects on-prem SharePoint farms exposed to CVE-2026-65660: ToolPane Register directive quote injection on AddGallery/ToolPane endpoints. Fingerprints MicrosoftSharePointTeamServices build and reachable layouts/15/ gallery edit surfaces without sending exploit markup. !/usr/bin/env python3 --...

Citrix NetScaler CVE-2026-88772 Detect

Detects Citrix NetScaler ADC/Gateway builds likely affected by CVE-2026-88772 memory buffer restriction flaw enabling RCE/DoS. Confirms NetScaler presence and pre-CTX697096 firmware where exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix NetScaler CVE-2026-88772 memory corruptio...

Citrix NetScaler CVE-2026-88771 Detect

Detects Citrix NetScaler ADC/Gateway instances likely affected by CVE-2026-88771. Confirms NetScaler presence, parses appliance build when exposed, and checks whether the AAA login path accepts the pitboss/PPE log trigger pattern used by nsmonuploadderr.pl. !/usr/bin/env python3 -- coding: utf-8 ...

Zyxel GS1900 CVE-2026-7273 Detect

Detects Zyxel GS1900 smart-managed switches running firmware 2.90XXXX.1C0 or earlier, vulnerable to CVE-2026-7273 stack-based buffer overflow in the web-management CGI program. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zyxel GS1900 CVE-2026-7273 CGI stack buffer overflow exposure."""...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Capability Probe (Python)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Python",...

Stage Cache (Python)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Stage Verify (Python)

Verify staged artifact SHA256 before callback uses stagecache when present !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify Python", "description": "Verify staged artifact...

Signed Config (Zig)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

Adobe Campaign Classic CVE-2026-83660 Detect

Detects Adobe Campaign Classic ACC instances likely affected by CVE-2026-83660 unauthenticated SSRF / privilege escalation and CVE-2026-89276 low-privilege code injection. Fingerprints ACC JSP surfaces and parses build numbers from /r/test against the APSB26-142 fixed build 7.4.4.9402...

Citrix NetScaler CVE-2026-88773 Detect

Detects Citrix NetScaler ADC/Gateway builds likely affected by CVE-2026-88773 HTTP request/response smuggling, CWE-444. Confirms NetScaler presence and parses appliance firmware against CTX697096 fixed builds 14.1-73.37+, 13.1-64.23+. Does not send smuggling probes. !/usr/bin/env python3 -- codin...

D-Link DIR-895L CVE-2026-100740 L2TP OOB Write Detection

Detects D-Link DIR-895L firmware A1102b07 and an exposed L2TP UDP/1701 service associated with CVE-2026-100740 Host Name AVP out-of-bounds write. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-100740 — D-Link DIR-895L L2TP Host Name AVP OOB write detection.""" from future import annotation...

Ivanti Neurons ITSM CVE-2026-12645 Detect

Detects Ivanti Neurons for ITSM formerly HEAT Service Management instances likely affected by CVE-2026-12645/12646/12647 missing authorization RCE and CVE-2026-12650 deserialization RCE. Fingerprints Login.aspx / AutomationService.svc surfaces and flags releases before 2026.2 when version metadat...

Magento CVE-2026-71362 Account Takeover Detect

Detects CVE-2026-71362 in Adobe Commerce / Magento Open Source before the APSB26-92 August 2026 patch: failed customer editPost poisons customerformdata and mass-assigns id into the active session. Registers a throwaway account and attempts a benign identity switch. !/usr/bin/env python3 -- codin...

Signed Config (PowerShell)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...

Netcore NR289-GE CVE-2026-101072 Detect

Detects CVE-2026-101072 in Netcore NR289-GE: unauthenticated OS command injection via POST /x.ico/apip.cgi boa .ico auth bypass. The ip parameter is embedded into a wget shell command without validation. Uses a short echo probe when activeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -...

Netcore NR289-GE CVE-2026-101077 Auth Bypass Detect

Detects CVE-2026-101077 in Netcore NR289-GE firmware V1.4.5102: the vendor boa web server whitelists any URI containing '.ico', skipping HTTP Basic authentication for all 441 cgitest.cgi handlers. Compares unauthenticated POST to /x.ico/aplistshow.cgi vs the protected path. !/usr/bin/env python3 ...

Citrix NetScaler CVE-2026-19490 Detect

Detects Citrix NetScaler ADC/Gateway deployments likely exposed to CVE-2026-19490 SAML alternate-path authentication bypass. Requires Gateway/AAA virtual server usage; flags affected 13.1/14.1 builds before 13.1-63.21 / 14.1-73.32 and reachable SAML endpoints. !/usr/bin/env python3 -- coding: utf...

JFrog Artifactory CVE-2026-42018 Detect

Detects CVE-2026-42018: POST /access/api/v1/aws/token/ trailing slash returns an internal anonymous-user JWT even when anonymous access is disabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JFrog Artifactory CVE-2026-42018 anonymous JWT via trailing slash.""" import json from kittysplo...

Netcore NAP930 CVE-2026-102240 Detect

Detects CVE-2026-102240 in Netcore NAP930 access points: pre-auth command injection in /cgi-bin/networktools via eval on raw QUERYSTRING before the sid session check. Confirms endpoint presence and optionally writes a marker file to /www/ when activeprobe is enabled. !/usr/bin/env python3 --...

Netcore NBR100V2 CVE-2026-101000 Detect

Detects CVE-2026-101000 in Netcore NBR100V2 LEDE/OpenWrt: when the device is factory-default initialized=0, anonymous ubus sessions may call uci.get on permitted configs via POST /ubus. Uses read-only uci.get probes — does not invoke uci.set or uci.apply. !/usr/bin/env python3 -- coding: utf-8 --...

Fortinet FortiOS CVE-2025-25249 CAPWAP Detect

Detects CVE-2025-25249 exposure by probing UDP/5246 with a benign CAPWAP Discovery Request. A response from cwacd indicates the fabric/CAPWAP control plane is reachable; combine with FortiOS version inventory to assess patch status fixed in 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18 / 6.4.17. !/usr/bin/env...

Netcore NAP930 CVE-2026-102240 network_tools RCE

Exploits CVE-2026-102240 in Netcore NAP930 via GET /cgi-bin/networktools?sid=';CMD;:'. The shell CGI evals QUERYSTRING before the session-id authorization check. Quotes and semicolons must be sent raw not URL-encoded. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NAP930 CVE-2026-102240...

WordPress Core CVE-2026-87902 Page Template LFI/RCE

Exploits CVE-2026-87902 when the active theme contains a page- directory and pearcmd.php is readable with registerargcargv enabled. Stage 1 uses double-encoded pagename traversal to include pearcmd and write a webroot marker; stage 2 executes verifycmd through the dropped PHP file. !/usr/bin/env...

WSO2 CVE-2026-5430 JWT Auth Bypass Detect

Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...

JFrog Artifactory CVE-2026-42016 Token Escalation

Chains CVE-2026-42018 anonymous JWT acquisition with CVE-2026-42016: POST /access/api/v1/tokens accepts a low-privilege token and returns an admin-scoped token when scope validation checks signature/issuer only. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory CVE-2026-42016 scope...

Telemetry Buffer (PowerShell)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

GitLab CVE-2026-85706 File Path LFI Detect

Detects CVE-2026-85706 in self-managed GitLab CE/EE before patched releases 17.11.7, 18.0.4, 18.1.2, 18.2.2, 18.3.2, 18.4.0: unauthenticated multipart uploads can supply file.path or metadata.path outside Workhorse temp dirs, leading to arbitrary file read. Sends a benign absolute-path probe only...

JFrog Artifactory CVE-2026-82329 Detect

Detects CVE-2026-82329: default Artifactory installs register a blank additional join key, allowing unauthenticated POST /access/api/v1/registry/join with an HS256 JWT signed using the publicly derivable 32-byte padded key. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JFrog Artifactory...

LiteLLM CVE-2026-59822 MCP Auth Bypass Detect

Detects CVE-2026-59822 in LiteLLM proxy before 1.84.0: failed LiteLLM key validation on the MCP Streamable HTTP endpoint falls back to an empty UserAPIKeyAuth object when a fabricated Authorization Bearer is supplied. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteLLM CVE-2026-59822 MCP...

SonicWall SMA1000 CVE-2026-83548 SSRF Detect

Detects CVE-2026-83548 in SonicWall SMA1000 WorkPlace before hotfixes 12.4.3-03526 / 12.5.0-02952. Sends an unauthenticated absolute-form OPTIONS request that WorkPlace forwards to loopback CouchDB; a 405 methodnotallowed JSON body confirms the SSRF primitive. !/usr/bin/env python3 -- coding: utf...

Check Point CVE-2026-93616 Management Detect

Detects exposure to CVE-2026-93616 on Check Point Quantum Security Management SmartConsole/SMS before R82.20 / JHF takes listed in sk1000171. Fingerprints the management web service on TCP/19009 and reachable HTTPS management panels without sending exploit upload payloads. !/usr/bin/env python3 -...

Magento CVE-2026-71362 Customer Account Takeover

Exploits CVE-2026-71362 APSB26-92: a failed customer account editPost leaves attacker-controlled customerformdata in session, and a later edit consumes mass-assigned id to rebind the session to another customer. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CVE-2026-71362 customer session...

Network Preflight (PowerShell)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight PowerShell", "description": "Probe callback...

Resource Guard (Python)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard Python", "description": "Exit early when...

Scope Guard (Zig)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard Zig", "description": "Exit when the callback host is outside the...

MikroTik RouterOS MikroTrick Chain Detect

Detects exposure to the MikroTrick exploit chain in MikroTik RouterOS before 6.49.21 / 7.23.4 / 7.24.2: SSH ROSSSH banner CVE-2026-86060 / CVE-2026-67279 and reachable btest bandwidth-server on TCP/2000 CVE-2026-67277. Does not attempt authentication bypass or kernel memory disclosure...

Scope Guard (PowerShell)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard PowerShell", "description": "Exit when the callback host i...

Magento StyleSmuggler Unauthenticated RCE (CVE-2026-75650)

Exploits CVE-2026-75650 StyleSmuggler via a two-stage unauthenticated chain: poison var/report through /paypal/transparent/response/, then trigger template evaluation through /graphql styles gadget parameters no email delivery required. !/usr/bin/env python3 -- coding: utf-8 -- """Magento / Adobe...

Scope Guard (Python)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard Python", "description": "Exit when the callback host is...

D-Link DIR-895L L2TP Host Name AVP OOB Write (CVE-2026-100740)

Out-of-bounds one-byte NUL write in the L2TP control parser on D-Link DIR-895L firmware A1102b07 when the Host Name AVP length is 127 peerhostname128. Requires L2TP WAN role / exposed UDP 1701. Set confirm=true to send the crafted SCCRQ trigger on authorized lab targets only. !/usr/bin/env python...

Network Preflight (Python)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Python", "description": "Probe callback...

Telemetry Buffer (Python)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Stage Verify (Zig)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify Zig", "description": "Verify staged artifact SHA256 before callback", "author"...