AirLive cgi_test.cgi RCE (CVE-2015-2279)

Exploits CVE-2015-2279 OS command injection in /cgitest.cgi via the writetan parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive cgitest.cgi command injection RCE CVE-2015-2279 — execute session.""" from future import annotations import re from...

Dahua ICC - GetClassValue.jsp RCE

Exploits unauthenticated remote code execution in Dahua Intelligent IoT Integrated Management Platform via RuntimeUtil.syncexecReturnInputStream on GetClassValue.jsp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua ICC GetClassValue.jsp RCE — execute...

OmniPCX - masterCGI RCE (CVE-2007-3010)

Exploits CVE-2007-3010 by injecting OS commands into the user parameter of /cgi-bin/masterCGI. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010 — execute session.""" from future import annotations import re from...

Gitlist blame RCE (CVE-2014-4511)

Exploits CVE-2014-4511 command injection in Gitlist blame paths via backtick-wrapped shell metacharacters. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Gitlist blame path command injection RCE CVE-2014-4511 — execute session.""" from future import annotations...

Webmin password_change.cgi RCE (CVE-2019-15107)

Exploits CVE-2019-15107 unauthenticated command injection in the passwordchange.cgi "old" parameter Webmin = 1.920. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin passwordchange.cgi RCE CVE-2019-15107 — execute session.""" from future import annotations...

CrushFTP CVE-2023-43177 Detection

Detects CVE-2023-43177 by confirming AS2 header injection on an anonymous session getUsername reflects forged username. !/usr/bin/env python3 -- coding: utf-8 -- """CrushFTP session hijacking + JDBC driver RCE CVE-2023-43177 detection.""" import re from kittysploit import from...

Apache Hadoop YARN - Unauthenticated RCE

Exploits unauthenticated YARN ResourceManager REST API to submit a malicious application whose AM container runs self.payload on a cluster worker node. Blind execution — use a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Hadoop YARN ResourceManager unauthenticated RCE ...

Apache Solr Velocity Template RCE (CVE-2019-0193)

Exploits CVE-2019-0193 Velocity template injection on /core/select when the VelocityResponseWriter is enabled. Runs OS commands via wt=velocity and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr Velocity template RCE CVE-2019-0193 — execute...

CrushFTP Unauthenticated RCE (CVE-2023-43177)

Exploits CVE-2023-43177 AS2 header injection to read sessions.obj, hijack or escalate to an administrator session, upload a malicious JDBC driver JAR, and execute a reverse CMD payload via testDB. CrushFTP versions prior to 10.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """CrushFTP...

WordPress File Manager RCE (CVE-2020-25213)

Exploits CVE-2020-25213 unauthenticated elFinder upload in wp-file-manager to drop a PHP shell, then runs commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress File Manager elFinder upload RCE CVE-2020-25213 — execute session.""" from futur...

Bash Shellshock HTTP CGI RCE (CVE-2014-6271)

Exploits CVE-2014-6271 by injecting :;; into HTTP headers against CGI-enabled paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — execute session.""" from future import annotations import re from kittysploit import...

Atlassian Confluence Setup Bypass RCE (CVE-2023-22515)

Exploits CVE-2023-22515 to reset setupComplete, create an administrator account, upload a malicious Confluence plugin servlet, and execute a reverse CMD payload. Affects Confluence 8.0.0–8.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence setup reset + admin creation + plugin...

Samsung WLAN AP WEA453e - Pre-Auth RCE

Exploits pre-authentication command execution on Samsung WLAN AP WEA453e via command1=shell: on /download/, then reads output through the download handler. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e pre-auth RCE — execute session."""...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

WANem result.php RCE (CVE-2012-10041)

Exploits CVE-2012-10041 command injection in WANem result.php via the pc parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """WANem result.php command injection RCE CVE-2012-10041 — execute session.""" from future import annotations import re from...

D-Link DNS-320/325 - system_mgr.cgi SMS Test RCE

Exploits command injection in cgismstest via the command1 parameter on /cgi-bin/systemmgr.cgi distinct from CVE-2020-25506 NTP injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi SMS test RCE — execute session.""" from...

ESVA - learn-msg.cgi RCE (CVE-2012-10046)

Exploits CVE-2012-10046 by injecting OS commands into the id parameter of /cgi-bin/learn-msg.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046 — execute session.""" from future import annotations import re...

Horde javascript.php Backdoor RCE (CVE-2012-0209)

Exploits CVE-2012-0209 by passing shell commands through the href Cookie to /services/javascript.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Horde javascript.php backdoor RCE CVE-2012-0209 — execute session.""" from future import annotations import re...

Apache NiFi H2 JDBC RCE Detection (CVE-2023-34468)

Detects Apache NiFi versions before 1.22.0 with API access to process groups. Such hosts may allow H2 JDBC URLs in DBCPConnectionPool CVE-2023-34468. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi H2 JDBC RCE surface detection CVE-2023-34468.""" from kittysploit import from...

Apache NiFi ExecuteProcess RCE

Abuses an unauthenticated or credentialed Apache NiFi REST API to create an ExecuteProcess processor in the root process group, run an OS command, then stop and delete the processor. Requires ExecuteProcess to be available on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi...

SAP Solution Manager EEM RCE (CVE-2020-6207)

Exploits CVE-2020-6207 missing authentication on /EemAdminService/EemAdmin to upload an AssignJS EEM script and execute self.payload on a connected SAP Diagnostics Agent via Rhino/Java Runtime. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Solution Manager EEM servlet RCE CVE-2020-6207 — rever...

Apache Solr CVE-2019-0193 Velocity RCE Detection

Detects CVE-2019-0193 by running a marker echo through the Velocity response writer on /core/select wt=velocity. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2019-0193 Velocity template RCE detection.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Elastix - graph.php File Read

Reads arbitrary files via Elastix vtigercrm/graph.php currentlanguage LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php currentlanguage file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

VICIdial manager_send.php RCE (CVE-2013-4468)

Exploits CVE-2013-4468 command injection via the extension parameter on /agc/managersend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection RCE CVE-2013-4468 — execute session.""" from future import annotations import...

Apache Commons Text RCE (CVE-2022-42889 / Text4Shell)

Exploits CVE-2022-42889 in Apache Commons Text 1.5–1.9 when the StringSubstitutor default interpolator evaluates $script:javascript:... lookups. Requires a vulnerable request parameter on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text StringSubstitutor RCE...

Narcissus - backend.php RCE (CVE-2012-10033)

Exploits CVE-2012-10033 by injecting OS commands into the release parameter of backend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Narcissus backend.php command injection CVE-2012-10033 — execute session.""" from future import annotations import re from...

Sangfor Application - download.php File Read

Reads arbitrary files via Sangfor Application /report/download.php?pdf= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Application download.php pdf parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Monitorix Pipe RCE (CVE-2013-7070)

Exploits CVE-2013-7070/7071 by injecting commands into pipe-wrapped Monitorix URL paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix pipe path command injection RCE CVE-2013-7070 — execute session.""" from future import annotations import re from...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

PhpWiki Ploticus RCE (CVE-2014-5519)

Exploits CVE-2014-5519 command injection in the Ploticus device attribute via edit preview on index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PhpWiki Ploticus device command injection RCE CVE-2014-5519 — execute session.""" from future import...

D-Link DIR - __show_info.php File Read (CVE-2017-12943)

Reads arbitrary files via REQUIREFILE on /model/showinfo.php CVE-2017-12943. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR showinfo.php file read CVE-2017-12943.""" from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Synology DSM - imageSelector.cgi RCE (CVE-2013-6955)

Exploits CVE-2013-6955 by appending shell commands into redirect.cgi via imageSelector.cgi SLICEUPLOAD, then reading output from /redirect.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM imageSelector.cgi RCE CVE-2013-6955 — execute session."""...

Basilic diff.php RCE

Exploits command injection in Basilic = 1.5.14 via the file parameter on /Config/diff.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection RCE — execute session.""" from future import annotations import re from...

Apache OFBiz Auth Bypass Groovy RCE (CVE-2023-51467)

Exploits CVE-2023-51467 authentication bypass empty credentials + requirePasswordChange=Y to reach /webtools/control/ProgramExport and run arbitrary Groovy via groovyProgram. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz auth bypass + Groovy RCE...

DedeCMS flink.php RCE

Exploits DedeCMS 5.8.1-beta variable override via Referer header injection on /plus/flink.php with the c query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS 5.8.1-beta flink.php variable override RCE — execute session.""" from future import...

vBSEO proc_deutf RCE (CVE-2012-5223)

Exploits CVE-2012-5223 eval injection in vBSEO via charrepl POST to vbseocp.php with base64 PHP in the Code header. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """vBSEO procdeutf eval RCE CVE-2012-5223 — execute session.""" from future import annotations import...

IceWarp WebClient RCE

Exploits unauthenticated PHP code injection in IceWarp WebClient via the dlgcaptchatarget parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebClient captcha target RCE — execute session.""" from future import annotations import re from...

Apache Solr CVE-2023-50386 Backup/Restore RCE Detection

Detects Apache Solr 6.0.0–8.11.2 / 9.0.0–9.4.0 in SolrCloud mode with reachable ConfigSets API CVE-2023-50386 attack surface. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2023-50386 detection backup/restore ConfigSet RCE surface.""" import re from kittysploit import from...

Honeywell IP Camera - check.cgi File Read

Reads arbitrary files via Honeywell IP camera /check.cgi?file= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell IP camera check.cgi file parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Grav CMS Blueprint dynamicData RCE (CVE-2026-65008)

Exploits CVE-2026-65008 in Grav CMS 2.0.7 fixed in 2.0.7: an authenticated user with admin.pages permission can plant a malicious forms frontmatter directive data-opts@ that routes through Blueprint::dynamicData to Grav\Common\Utils::arrayFilterRecursive and system. Execution triggers when any...

Ghost CMS Remote Code Execution (CVE-2026-29053)

Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...

Linksys E1200 v2 - tmUnblock.cgi Command Injection (CVE-2025-60689)

Unauthenticated OS command injection in Linksys E1200 firmware = v2.0.04 via POST /tmUnblock.cgi ttcpip. Blind injection: use the default reverse payload/listener or nopayload + execute session. Admin UI is often on port 80 or 8080 depending on deployment. !/usr/bin/env python3 -- coding: utf-8 -...

WePresent WiPG-1000 RCE

Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """WePresent WiPG-1000 RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Cisco RV320 Command Injection

Module exploits Cisco RV320 Remote Command Injection vulnerability in the web-based certificate generator feature. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320 Command Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

2Wire 4011G & 5012NV Path Traversal

Module exploits path traversal vulnerability in 2Wire 4011G and 5012NV devices. If the target is vulnerable it is possible to read file from the filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """2Wire 4011G & 5012NV Path Traversal""" import re from kittysploit import from...

D-Link DSP-W110 RCE

Module exploits D-Link DSP-W110 Remote Command Execution vulnerability which allows executing command on the operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DSP-W110 RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DWL-3200AP Password Disclosure

Exploits D-Link DWL3200 access points weak cookie value. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWL-3200AP Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'D-Link DWL-3200A...

Belkin Auth Bypass

Module exploits Belkin authentication using MD5 password disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin Auth Bypass""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient: info = 'name': 'Belkin Auth Bypass',...

Netgear Multi Password Disclosure

Module exploits Password Disclosure vulnerability in multiple Netgear devices. If target is vulnerable administrator's password is retrieved. This exploit only works if 'password recovery' in router settings is OFF. If the exploit has already been run, then it might not work anymore until device...