EyouCms v1.6.3 - Information Disclosure Detection

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custommodelpath/recruit.filelist.txt. !/usr/bin/env python3 -- coding: utf-8 -- """EyouCms v1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Fortinet FortiSIEM - Panel Detection

FortiSIEM login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """FortiSIEM login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiSIEM - Panel Detection',...

AVCON6 - Arbitrary File Download Detection

File Download vulnerability in the download.action of the AVCON6 system management platform, through which an attacker can download arbitrary files from the server !/usr/bin/env python3 -- coding: utf-8 -- """File Download vulnerability in the download.""" import re from kittysploit import from...

SteVe - Cross-Site Scripting Detection

SteVe contains a cross-site scripting vulnerability. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env python3 --...

Shoppable Service Auth Token Detection

Detects Shoppable Service Auth Token. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Shoppable Service Auth Token.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Shoppable Service Auth Token Detection',...

Semantic UI Framework - Detect

Detects the presence of Semantic UI, a development framework that helps create beautiful, responsive layouts using human-friendly HTML. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Semantic UI, a development framework that helps create beautiful, responsive layouts u."""...

elFinder 2.1.58 - Remote Code Execution Detection

elFinder 2.1.58 is vulnerable to remote code execution. This can allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. !/usr/bin/env python3 -- coding: utf-8 -- """elFinder 2.""" from kittysploit import from...

NETGEAR Routers - Remote Code Execution Detection

NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow...

Sony IPELA Engine IP Camera - Hardcoded Account Detection

Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple SONY network cameras are vulnerable to sensitive information disclosure via hardcoded credentials.""" from kittysploit import from...

node-srv - Local File Inclusion Detection

node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a malicious user to read content of any file with known path. !/usr/bin/env python3 -- coding: utf-8 -- """node-srv is vulnerable to local file inclusion due to lack of url validation, which allows a...

Dolibarr <7.0.2 - Cross-Site Scripting Detection

Dolibarr before 7.0.2 is vulnerable to cross-site scripting and allows remote attackers to inject arbitrary web script or HTML via the foruserlogin parameter to adherents/cartes/carte.php. !/usr/bin/env python3 -- coding: utf-8 -- """Dolibarr before 7.""" from kittysploit import from...

ListingPro < 2.6.1 - Sensitive Data Disclosure Detection

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...

Detect Gunicorn Server

Gunicorn Python WSGI HTTP Server for UNIX !/usr/bin/env python3 -- coding: utf-8 -- """Gunicorn Python WSGI HTTP Server for UNIX.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Gunicorn Server',...

cgit < 1.2.1 - Directory Traversal Detection

cGit 1.2.1 via cgitcloneobjects has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. !/usr/bin/env python3 -- coding: utf-8 -- """cGit 1.""" import re from kittysploit import from...

Squidex Headless CMS Panel - Detect

Squidex is an open source headless CMS and content management hub. !/usr/bin/env python3 -- coding: utf-8 -- """Squidex is an open source headless CMS and content management hub.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

MemTracker - Exposure Detection

MemTracker was detected and appeared to be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """MemTracker was detected and appeared to be accessible without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

MCPJam Inspector CVE-2026-23744 unauthenticated RCE

CVE-2026-23744: MCPJam Inspector = 1.4.2 exposes /api/mcp/connect without authentication and spawns attacker-controlled serverConfig.command/args. The app binds to 0.0.0.0 by default, enabling remote unauthenticated RCE. Fixed in 1.4.3+. !/usr/bin/env python3 -- coding: utf-8 -- import base64 fro...

FortiClient EMS CVE-2026-21643 pre-auth SQLi confirmation

Actively confirms CVE-2026-21643 FortiClient EMS 7.4.4 multi-tenant by injecting SQL through the Site HTTP header. Default path is error-based GET /api/v1/initconsts safe, no lockout. Optional time-based POST /api/v1/auth/signin locks out after 3 attempts. !/usr/bin/env python3 -- coding: utf-8 -...

Apache Superset CVE-2026-23980 detection

Detects Apache Superset and flags versions 6.0.0 as affected by CVE-2026-23980 authenticated error-based SQLi via chart/data sqlExpression/where. Optional credential probe confirms injection. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing import Optional, Tuple from kittysploit...

Drupal CVE-2026-9082 PostgreSQL SQLi Detect

Detects CVE-2026-9082 SA-CORE-2026-004 on PostgreSQL-backed Drupal via JSON:API filter value array keys. Confirms the blind error oracle: injected key 0||1/CASE WHEN 1=1 THEN 0 ELSE 1 END yields HTTP 500, 1=0 yields HTTP 200 on GET /jsonapi/type?filteracondition... !/usr/bin/env python3 -- coding...

WordPress Divi Form Builder CVE-2026-5118 admin creation

CVE-2026-5118: Divi Form Builder = 5.1.2 accepts a client-supplied role on defbajaxsubmitajaxhandler during registration. Harvests fbnonce from the site, then POSTs multipart register with role=administrator to create an unauthenticated WordPress admin. Fixed in 5.1.3+. !/usr/bin/env python3 --...

WordPress Kirki CVE-2026-8206 password-reset takeover

CVE-2026-8206: Kirki 6.0.0–6.0.6 CompLibFormHandler accepts an arbitrary email when resetting by username. POSTs to /wp-json/KirkiComponentLibrary/v1/kirki-forgot-password with X-WP-Element-Nonce, redirecting the victim's reset link to attackeremail. Does not complete the password change requires...

WordPress User Registration Membership CVE-2026-1492 admin escalation

CVE-2026-1492: User Registration & Membership = 5.1.2 accepts a client-supplied role in userregistrationmembershipregistermember without a server-side allowlist. This module discovers membership registration forms, registers a user, then injects role=administrator via AJAX to create a privileged...

Windows Gather Defender CVE-2026-41091 / CVE-2026-45498 Audit

Post gather for Microsoft Defender CVE-2026-41091 LPE via Malware Protection Engine link-following and CVE-2026-45498 Antimalware Platform DoS. Reads AMEngineVersion / AMProductVersion via Get-MpComputerStatus, compares against fixed floors ... / ..., and lists MsMpEng/NisSrv/Sense processes...

Palo Alto GlobalProtect CVE-2026-0265 CAS auth bypass detection

Detects whether a GlobalProtect portal is vulnerable to CVE-2026-0265 CAS JWT signature bypass via a single anonymous GET to /global-protect/prelogin.esp. Requires Cloud Authentication Service CAS attached and a PAN-OS build below the advisory hotfix cutoff. No authentication is attempted and no...

Ivanti Sentry CVE-2026-10520 detection

Detects Ivanti Sentry vulnerable to CVE-2026-10520 by posting a benign commandexec id to /mics/api/v2/sentry/mics-config/handleMessage and checking for unauthenticated root-level command output. !/usr/bin/env python3 -- coding: utf-8 -- import json import re from urllib.parse import quote from...

UniFi Network Application CVE-2026-22557 — path traversal file read

Exploits CVE-2026-22557: unauthenticated arbitrary file read through the guest portal pageerror parameter on /guest/s//wechat/sign and /login. Uses lib.protocols.http.lfi for one-shot reads or an interactive LFI shell. Pair with scanner/http/unificve202622557. Note: full OS file disclosure...

WordPress User Registration Membership CVE-2026-1492 detection

Detects the User Registration & Membership plugin and flags versions = 5.1.2 as affected by CVE-2026-1492 unauthenticated administrator creation via membership registermember role injection. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient impor...

Cisco Catalyst SD-WAN CVE-2026-20182 detection

Detects CVE-2026-20182 by performing the vdaemon DTLS handshake on UDP/12346 and sending a CHALLENGEACK claiming devicetype=2 vHub. A CHALLENGEACKACK response indicates the authentication bypass is present. No SSH key is injected. !/usr/bin/env python3 -- coding: utf-8 -- import os import shutil...

Cisco Catalyst SD-WAN CVE-2026-20182 vHub auth bypass

CVE-2026-20182: Cisco Catalyst SD-WAN Controller/Manager vdaemon DTLS UDP/12346 skips certificate verification for peers claiming to be a vHub devicetype=2. This module bypasses peering authentication, injects an SSH public key into the vmanage-admin authorizedkeys file, and optionally verifies...

Langflow CVE-2026-5027 path traversal file write RCE

Exploits CVE-2026-5027: unsanitized multipart filename on POST /api/v2/files Langflow = 1.8.4. With default auto-login, unauthenticated arbitrary file write. Modes: proof /tmp, cron drop /etc/cron.d reverse shell, write custom path/content. Fixed in 1.9.0+. !/usr/bin/env python3 -- coding: utf-8 ...

Ghost CMS CVE-2026-26980 detection

Detects Ghost CMS and confirms CVE-2026-26980 unauthenticated Content API slug filter SQL injection, 3.24.0–6.19.0. Scrapes the public Content API key from HTML, then verifies the EXP710 boolean oracle on /ghost/api/content/tags/. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing...

pypdf CVE-2026-24688 circular outline DoS PDF

Generates a malicious PDF with circular outline/bookmark references A→B→A or nested /First cycle. Vulnerable pypdf str: return text.replace"\", "\\".replace"", "\".replace"", "\" def writepdfpath: Path, objects: list - None: """Write a minimal PDF with a correct xref table 1-indexed...

Apache Superset CVE-2026-23980 chart/data SQLi

Exploits CVE-2026-23980: authenticated or PUBLICROLE error-based SQL injection via sqlExpression/where on POST /api/v1/chart/data. Supports direct extraction, CAST error leakage, and PostgreSQL querytoxml bypass. Affected: Superset 6.0.0. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-2398...

MCPJam Inspector CVE-2026-23744 detection

Detects exposed MCPJam Inspector instances and probes unauthenticated access to /api/mcp/connect CVE-2026-23744 RCE via serverConfig spawn. Affected: = 1.4.2. Fixed in 1.4.3+. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Ghost CMS CVE-2026-26980 Content API SQLi

Exploits CVE-2026-26980: unauthenticated blind SQL injection in Ghost Content API slug filter ordering 3.24.0–6.19.0, fixed in 6.19.1. Uses the public Content API key and an EXP710 MySQL boolean oracle HTTP 200/500. Supports test, targeted dumps, and Sqli pseudo-shell. !/usr/bin/env python3 --...

UniFi Network Application CVE-2026-22557 detection

Detects unauthenticated path traversal via the guest portal pageerror parameter CVE-2026-22557 / SAB-062. Calibrates with system.properties, then confirms the customized-portal filesystem branch with firmware.json and optionally web.xml via /login. Fixed in 10.1.89 / 10.2.97 / 9.0.118...

Ivanti Sentry CVE-2026-10520 unauthenticated OS command injection

CVE-2026-10520: Ivanti Sentry before R10.5.2, R10.6.2, R10.7.1 exposes /mics/api/v2/sentry/mics-config/handleMessage without authentication. An attacker can inject OS commands via the commandexec MICS message and achieve root-level remote code execution. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Kirki CVE-2026-8206 detection

Detects Kirki Freeform Page Builder and flags versions 6.0.0–6.0.6 affected by CVE-2026-8206: CompLibFormHandler accepts an attacker-controlled email on POST /wp-json/KirkiComponentLibrary/v1/kirki-forgot-password, redirecting password-reset links. Fixed in 6.0.7+. !/usr/bin/env python3 -- coding...

WordPress Divi Form Builder CVE-2026-5118 detection

Detects Divi Engine Divi Form Builder and flags versions = 5.1.2 affected by CVE-2026-5118 unauthenticated admin creation via defbajaxsubmitajaxhandler role=administrator. Looks for fbnonce / defbobj markers and plugin assets. Fixed in 5.1.3+. !/usr/bin/env python3 -- coding: utf-8 --...

Langflow CVE-2026-5027 path traversal detection

Detects Langflow = 1.8.4 affected by CVE-2026-5027 unsanitized multipart filename on POST /api/v2/files → arbitrary file write. Checks /api/v1/version, probes auto-login, and optionally confirms with a benign write to /tmp. Fixed in 1.9.0+. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-50...

nginx-ui CVE-2026-33032 MCP auth bypass (tools/list)

Confirms CVE-2026-33032 by obtaining an unauthenticated MCP sessionID and calling a read-only JSON-RPC method default tools/list on /mcpmessage. Refuses destructive MCP tool calls nginxreload, config edits, etc.. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-33032 — nginx-ui unauthenticat...

nginx-ui CVE-2026-33032 MCPwn detection

Non-destructive detector for CVE-2026-33032 MCPwn: missing AuthRequired on nginx-ui /mcpmessage. Fingerprints nginx-ui, obtains an unauthenticated MCP sessionID via /mcp SSE, then sends benign tools/list JSON-RPC to /mcpmessage. Never invokes destructive MCP tools. Affected builds prior to the...

Drupal PostgreSQL SQLi (CVE-2026-9082)

CVE-2026-9082 SA-CORE-2026-004: PostgreSQL-only blind SQL injection via JSON:API filter value array keys or POST /user/login name keys. translateCondition concatenates the key into a PDO placeholder; 0||1/CASE WHEN predicate THEN 0 ELSE 1 END turns true predicates into HTTP 500 divisionbyzero and...

ZoneMinder CVE-2026-27470 detection

Detects ZoneMinder and flags versions affected by CVE-2026-27470 second-order SQLi in getNearEvents via stored Event Name/Cause. Affected: = 1.36.37 and 1.37.61–1.38.0. Fixed: 1.36.38 / 1.38.1. Optional credentials enable a light auth probe for Events API access. !/usr/bin/env python3 -- coding:...

ZoneMinder CVE-2026-27470 second-order SQLi

Exploits CVE-2026-27470: authenticated second-order SQL injection in ZoneMinder getNearEvents web/ajax/status.php. Stores a UNION payload in Event Name/Cause parameterized write, then triggers via entity=nearevents. Affected: = 1.36.37 and 1.37.61–1.38.0. Fixed: 1.36.38 / 1.38.1. Requires Events...

WebKit CVE-2026-20643 NavigateEvent.canIntercept check

Checks whether NavigateEvent.canIntercept is incorrectly true for same-host cross-port navigations CVE-2026-20643 / WebKit Navigation API SOP gate bug. Reports VULNERABLE when canIntercept=true on a cross-origin target, PATCHED when false, or INCONCLUSIVE when the Navigation API is unavailable or...

Windows Office CVE-2026-21509 kill-bit manage

Post-exploitation module for CVE-2026-21509 Office OLE/COM kill-bit bypass around Shell.Explorer.1 / CLSID EAB22AC3-30C1-11CF-A7EB-0000C05BAE0B. Checks registry Compatibility Flags=0x400, applies/removes the temporary kill-bit mitigation, checks related KBs, or writes a dummy RTF probe. Requires ...

FreeScout CVE-2026-28289 detection

Fingerprints FreeScout and compares the reported version against CVE-2026-28289 = ..., fixed in .... Optional admin credentials can be used only to read the version from the authenticated footer. Version check only — no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- import re from typing...

PDF CVE-2026-57259 Foxit XXE Callback

Generate PDF PoC for CVE-2026-57259: Foxit XML/XXE phone-home via XMP parameter entity lab callback URL. For authorized parser/viewer regression. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.pdf.mixins import PdfCveMixin from lib.pdf.generators.xxe import...