Froxlor CVE-2026-100717 CRLF Detect

Detects Froxlor server administration panels affected by CVE-2026-100717 Validate::validateUrl CRLF in userinfo. Versions 2.3.10 and earlier allow authenticated customers with subdomain rights to inject nginx/Apache directives via redirect URLs. Fingerprints Froxlor and compares reported version...

Netcore NR289-GE CVE-2026-101076 Detect

Detects CVE-2026-101076 in Netcore NR289-GE: unauthenticated OS command injection via POST /x.ico/setntpserverip.cgi. The ntpip parameter is passed to system inside a wget command template. Uses a short echo probe when activeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect...

PaperCut CVE-2026-81578 Auth Bypass Detect

Detects CVE-2026-81578 in PaperCut NG/MF before 24.1.10 / 25.0.13 / 26.0.5. Apache Tapestry direct/1/Home/ConfigEditor requests validate only the render page Home while invoking privileged ConfigEditor listeners without a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

SonicWall SMA1000 CVE-2026-83549 RCE Chain Detect

Detects SMA1000 firmware branches vulnerable to CVE-2026-83549 when chained with CVE-2026-83548. Fingerprints WorkPlace/AMC build headers and flags pre-hotfix platform versions 12.4.3 before 03526, 12.5.0 before 02952. Does not invoke sysCtrl or inject SNMP trap commands. !/usr/bin/env python3 --...

N-able N-central CVE-2026-86218 Detect

Detects N-able N-central builds before 2026.3.1.14 Hotfix 4 that expose the pre-authentication /remoteControlAction.do?method=getPierDetails reconnaissance endpoint associated with CVE-2026-86218 static code injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect N-able N-central...

Resource Guard (PowerShell)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard PowerShell", "description": "Exit early whe...

Stage Cache (Zig)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Sangoma Switchvox CVE-2026-9586 SQLi Detect

Detects CVE-2026-9586 in Sangoma Switchvox SMB before 8.4.0.2. The unauthenticated /pa phone-notification endpoint concatenates XML PhoneIP values into PostgreSQL queries. Uses a benign syntax-error probe only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Sangoma Switchvox CVE-2026-9586...

Magento StyleSmuggler Unauthenticated RCE (CVE-2026-75650)

Exploits CVE-2026-75650 StyleSmuggler via a two-stage unauthenticated chain: poison var/report through /paypal/transparent/response/, then trigger template evaluation through /graphql styles gadget parameters no email delivery required. !/usr/bin/env python3 -- coding: utf-8 -- """Magento / Adobe...

Scope Guard (PowerShell)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard PowerShell", "description": "Exit when the callback host i...

Scope Guard (Python)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard Python", "description": "Exit when the callback host is...

Metabase - H2 Deserialization RCE Detection (CVE-2026-59827)

Detects potentially vulnerable Metabase versions affected by CVE-2026-59827 unsafe Java deserialization of H2 OTHER columns in native queries. Confirms version via /api/session/properties; full exploitation requires authenticated native-query access to an H2 database. !/usr/bin/env python3 --...

FreePBX - Unauth SQLi Detection (CVE-2025-57819)

Detects CVE-2025-57819 via error-based SQL injection on /admin/ajax.php brand parameter, Endpoint Manager module. Confirms MySQL XPATH error leaking freepbxuser. Full RCE requires stacked-query cronjobs injection. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX Endpoint Manager unauth SQLi...

Metabase - H2 Deserialization RCE (CVE-2026-59827)

Exploits CVE-2026-59827 by authenticating to Metabase, locating an H2 database including the default sample DB, and submitting a native query that deserializes a Clojure PriorityQueue gadget chain via SELECT CASTX'...' AS OTHER. Command execution is blind — output is not returned over HTTP...

Apache NiFi H2 JDBC RCE (CVE-2023-34468)

Exploits CVE-2023-34468 by creating a DBCPConnectionPool controller service with a malicious H2 JDBC URL INIT=RUNSCRIPT FROM attacker, enabling it, and triggering ExecuteSQL. Affected NiFi 0.0.2 through 1.21.0. Requires permission to create controller services often unauthenticated. !/usr/bin/env...

Apache Solr Backup/Restore RCE (CVE-2023-50386)

Exploits CVE-2023-50386 by uploading a malicious ConfigSet containing SourceParser.class, creating a collection, using BACKUP APIs to place the class on Solr's classpath, then loading it via a second ConfigSet. Requires SolrCloud ZooKeeper. Solr 6.0.0–8.11.2 and 9.0.0–9.4.0. !/usr/bin/env python3...

Atlassian Confluence SSTI RCE (CVE-2023-22527)

Exploits CVE-2023-22527 OGNL injection on /template/aui/text-inline.vm to run arbitrary OS commands via freemarker Execute.exec. Confluence 8.0.0–8.5.3 are affected. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence SSTI / OGNL RCE CVE-2023-22527 — reverse CMD session.""" from...

Fortra GoAnywhere MFT Auth Bypass RCE (CVE-2024-0204)

Exploits CVE-2024-0204 to create an administrator via the InitialAccountSetup wizard path traversal, upload a JSP payload through the FileManager, and execute a reverse CMD command. GoAnywhere MFT 6.0.1 through 7.4.0. !/usr/bin/env python3 -- coding: utf-8 -- """Fortra GoAnywhere MFT auth bypass ...

HybridAuth - install.php RCE (CVE-2014-125116)

Exploits CVE-2014-125116 by writing system$POST0 into config.php via the HybridAuth installer, then invoking commands through config.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """HybridAuth install.php / config.php RCE CVE-2014-125116 — execute session.""...

Samsung WLAN AP WEA453e - File Read

Reads arbitrary files via the /download/ handler on Samsung WLAN AP WEA453e devices. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e download path file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

Sangfor NGAF - loadfile.php File Read

Reads arbitrary files via Sangfor Next Gen Application Firewall /svpnhtml/loadfile.php file parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor NGAF loadfile.php arbitrary file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

ALCASAR Host Header RCE

Exploits ALCASAR command injection via a crafted Host header on /alcasar/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ALCASAR Host header command injection RCE — execute session.""" from future import annotations import re from kittysploit import...

PineApp Mail-SeCure test_li_connection RCE

Exploits command injection in PineApp Mail-SeCure via the iptest parameter on /admin/testliconnection.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PineApp Mail-SeCure testliconnection.php RCE — execute session.""" from future import annotations import re...

EditWrxLite - wrx.cgi RCE

Exploits EditWrxLite command injection via the download parameter of wrx.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """EditWrxLite wrx.cgi command injection RCE — execute session.""" from future import annotations import re from urllib.parse import quote...

Apache Druid JavaScript RCE (CVE-2021-25646)

Exploits CVE-2021-25646 by enabling the JavaScript parser through /druid/indexer/v1/sampler and running arbitrary OS commands. Druid 0.20.1; authentication is off by default. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Druid JavaScript sampler RCE...

Apache Struts2 S2-057 OGNL RCE (CVE-2018-11776)

Exploits CVE-2018-11776 S2-057 OGNL injection via crafted namespace paths when alwaysSelectFullNamespace is enabled. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-057 OGNL RCE CVE-2018-11776 — execute session.""" from future import annotation...

Drupal RESTWS passthru RCE

Exploits Drupal RESTWS module RCE via taxonomyvocabulary passthru callbacks SA-CONTRIB-2016-040. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal RESTWS taxonomyvocabulary passthru RCE — execute session.""" from future import annotations import re from...

DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...

OpenCPU RCE via do.call

Exploits unauthenticated R code execution on OpenCPU via /ocpu/library/base/R/do.call/json with systempaste.... Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCPU R do.call system RCE — execute session.""" from future import annotations import json import r...

Piwik Loader.php Backdoor RCE

Exploits the historical Piwik Loader.php backdoor via the g=system query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Piwik/Matomo Loader.php backdoor RCE — execute session.""" from future import annotations import re from kittysploit import from...

Apache OFBiz CVE-2023-51467 Auth Bypass Detection

Detects CVE-2023-51467 by accessing /webtools/control/ping with empty credentials and requirePasswordChange=Y, then confirming Groovy execution via ProgramExport. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz CVE-2023-51467 authentication bypass detection.""" import re from kittysploi...

ManageEngine SDP - FileDownload.jsp fName File Read

Reads arbitrary files via ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal with null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp fName file read.""" from urllib.parse import quote from kittysploit import from...

WedgeOS - ssgimages File Read

Reads arbitrary files via WedgeOS = 4.0.4 /ssgmanager/ssgimages?name= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """WedgeOS ssgimages name parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

AlienVault OSSIM av-centerd RCE (CVE-2014-3804)

Exploits CVE-2014-3804 command injection in the av-centerd updatesysteminfodebianpackage SOAP method. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804 — execute session.""" from future import annotations import r...

Sangfor EDR - slog_client RCE

Exploits unauthenticated command injection in Sangfor EDR 3.2.17R1/3.2.21 via /api/edr/sangforinter/v2/cssp/slogclient JSON params. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor EDR 3.2.17R1/3.2.21 slogclient RCE — execute session.""" from future impor...

Apache Archiva OGNL RCE (CVE-2013-2251)

Exploits CVE-2013-2251 OGNL injection via redirect: on /security/login.action. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Archiva Struts OGNL RCE CVE-2013-2251 — execute session.""" from future import annotations import re from urllib.parse import...

ConnectWise ScreenConnect Auth Bypass RCE (CVE-2024-1709)

Exploits CVE-2024-1709 to recreate the setup wizard and register an administrator, then CVE-2024-1708 path traversal in extension install to drop a .ashx handler that runs a reverse CMD payload. ScreenConnect = 23.9.7. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect auth...

GeoServer Unauthenticated RCE (CVE-2024-36401)

Exploits CVE-2024-36401 XPath injection in GeoServer WFS GetPropertyValue. Affected: 2.23.6, 2.24.0–2.24.3, 2.25.0–2.25.1. Blind RCE confirmed by HTTP 400 + ClassCastException. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer unauthenticated XPath injection RCE CVE-2024-36401 — reverse CMD...

SAP NetWeaver ConfigServlet RCE

Exploits unauthenticated command execution via EXECUTECMD on /ctc/servlet/ConfigServlet/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver ConfigServlet EXECUTECMD RCE — execute session.""" from future import annotations import re from urllib.parse...

Apache Commons Text CVE-2022-42889 Detection

Detects CVE-2022-42889 Text4Shell via a blind sleep injection using the script:javascript StringSubstitutor lookup on a target parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text CVE-2022-42889 Text4Shell detection.""" import random import time from kittysploit import from...

Atlassian Confluence Setup Bypass RCE (CVE-2023-22515)

Exploits CVE-2023-22515 to reset setupComplete, create an administrator account, upload a malicious Confluence plugin servlet, and execute a reverse CMD payload. Affects Confluence 8.0.0–8.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence setup reset + admin creation + plugin...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

nostromo nhttpd RCE (CVE-2019-16278)

Exploits CVE-2019-16278 directory traversal in httpverify to invoke /bin/sh on nostromo nhttpd = 1.9.6. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """nostromo nhttpd path traversal RCE CVE-2019-16278 — execute session.""" from future import annotations import ...

GeoVision GeoHttpServer - Path Traversal File Read

Reads arbitrary files via GeoVision GeoHttpServer = 8.3.3.0 path traversal using /.../.../ style segments. !/usr/bin/env python3 -- coding: utf-8 -- """GeoVision GeoHttpServer path traversal file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

CERIO DT - Save.cgi Command Injection RCE

Exploits command injection in the ip field of /cgi-bin/Save.cgi PING operation on CERIO DT series routers. Requires default operator credentials. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """CERIO DT series router Save.cgi command injection — execute...

D-Link DNS-320/325 - system_mgr.cgi SMS Test RCE

Exploits command injection in cgismstest via the command1 parameter on /cgi-bin/systemmgr.cgi distinct from CVE-2020-25506 NTP injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi SMS test RCE — execute session.""" from...

Samsung WLAN AP WEA453e - Pre-Auth RCE

Exploits pre-authentication command execution on Samsung WLAN AP WEA453e via command1=shell: on /download/, then reads output through the download handler. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e pre-auth RCE — execute session."""...

WANem result.php RCE (CVE-2012-10041)

Exploits CVE-2012-10041 command injection in WANem result.php via the pc parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """WANem result.php command injection RCE CVE-2012-10041 — execute session.""" from future import annotations import re from...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

TWiki debugenableplugins RCE (CVE-2014-7236)

Exploits CVE-2014-7236 Perl injection via debugenableplugins on /view/Main/WebHome. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins Perl RCE CVE-2014-7236 — execute session.""" from future import annotations import re from urllib.parse...