Certifried CVE-2022-26923 Detect

Detects prerequisites for CVE-2022-26923 Certifried: authenticated LDAP access, ms-DS-MachineAccountQuota 0, AD CS enrollment service, and the Machine certificate template. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Certifried CVE-2022-26923 prerequisite conditions.""" from kittysploit...

D-Link NAS Backdoor RCE (CVE-2024-3272)

Exploits CVE-2024-3272 in D-Link DNS-320L/325/327L/340L: hard-coded messagebus account in nassharing.cgi cmd=15 runs base64-encoded shell commands. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link NAS messagebus backdoor RCE CVE-2024-3272.""" import base64 import re from kittysploit import fro...

Zyxel NAS weblogin RCE (CVE-2020-9054)

Exploits CVE-2020-9054 in Zyxel NAS firmware 5.21: pre-auth command injection via the username parameter of /cgi-bin/weblogin.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS weblogin.cgi command injection CVE-2020-9054.""" import re import urllib.parse from kittysploit import from...

NTLM Coercion Multi-Method

Attempts multiple NTLM coercion primitives against a Windows target: PetitPotam EfsRpcOpenFileRaw and DFSCoerce NetrDfsRemoveStdRoot. Use with SMB or HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """Multi-method NTLM coercion PetitPotam + DFSCoerce.""" from kittysploit import fr...

Starlette Host Header Auth Bypass (CVE-2026-48710)

Exploits CVE-2026-48710 by sending a malformed Host header so request.url differs from the raw scope path, bypassing middleware and endpoint restrictions that rely on request.url validation. !/usr/bin/env python3 -- coding: utf-8 -- """Starlette Host header bypass CVE-2026-48710 — auth restrictio...

DFSCoerce NTLM Coercion

Coerces a Windows target to authenticate to an attacker listener via NetrDfsRemoveStdRoot over the netdfs named pipe DFSCoerce. Use with SMB/HTTP relay listeners. !/usr/bin/env python3 -- coding: utf-8 -- """DFSCoerce NTLM coercion via NetrDfsRemoveStdRoot MS-DFSNM.""" from kittysploit import fro...

ASUS DSL-AC88U Auth Bypass (CVE-2024-3080)

Exploits CVE-2024-3080 in ASUS DSL-AC88U: /js/..%2f%2f or /images/..%2f%2e traversal bypasses authentication and exposes admin wizard pages. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS DSL-AC88U path traversal auth bypass CVE-2024-3080.""" from kittysploit import from...

CirCarLife Auth Bypass (CVE-2018-16670)

Exploits CVE-2018-16670 in CirCarLife 4.3: unauthenticated access to /html/devstat.html and /services/user/values.xml exposes PLC status data. !/usr/bin/env python3 -- coding: utf-8 -- """CirCarLife devstat auth bypass CVE-2018-16670.""" from kittysploit import from lib.protocols.http.httpclient...

BOA Web Server LFI (CVE-2017-9833)

Exploits CVE-2017-9833 in BOA Web Server 0.94.14 common in IP cameras/DVRs: FILECAMERA traversal in /cgi-bin/wapopen reads arbitrary files as root. !/usr/bin/env python3 -- coding: utf-8 -- """BOA Web Server FILECAMERA LFI CVE-2017-9833.""" import re import urllib.parse from kittysploit import fr...

Cisco RV320 Config Leak (CVE-2019-1653)

Exploits CVE-2019-1653 in Cisco RV320/RV325: unauthenticated GET to /cgi-bin/config.exp downloads the full router configuration including credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV320/RV325 config disclosure CVE-2019-1653.""" from kittysploit import from...

D-Link DAP-1620 LFI (CVE-2021-46381)

Exploits CVE-2021-46381 in D-Link DAP-1620: path traversal via htmlresponsepage in POST /apply.cgi reads /etc/passwd and /etc/shadow without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-1620 apply.cgi traversal LFI CVE-2021-46381.""" import re from kittysploit import fr...

D-Link DIR-868L Credential Leak (CVE-2019-17506)

Exploits CVE-2019-17506 in D-Link DIR-868L/817LW: unauthenticated POST to getcfg.php with AUTHORIZEDGROUP newline injection returns admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-868L getcfg credential leak CVE-2019-17506.""" from kittysploit import from...

DrayTek Router RCE (CVE-2020-8515)

Exploits CVE-2020-8515 in DrayTek Vigor routers: unauthenticated command injection via keyPath in /cgi-bin/mainfunction.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek mainfunction.cgi command injection CVE-2020-8515.""" import re from kittysploit import from lib.protocols.http.httpclie...

Eaton IPM LFI (CVE-2018-12031)

Exploits CVE-2018-12031 in Eaton Intelligent Power Manager 1.6: directory traversal via nodeupgradesrv.js downloadFirmware reads /etc/passwd and more. !/usr/bin/env python3 -- coding: utf-8 -- """Eaton Intelligent Power Manager traversal LFI CVE-2018-12031.""" import re from kittysploit import fr...

Fieldgate SWG70 LFI (CVE-2018-16059)

Exploits CVE-2018-16059 in WirelessHART Fieldgate SWG70 3.0: path traversal via fcgi-bin/wgsetcgi filename parameter reads /etc/passwd and other files. !/usr/bin/env python3 -- coding: utf-8 -- """Endress+Hauser Fieldgate SWG70 LFI CVE-2018-16059.""" import re from kittysploit import from...

FortiMail Path Traversal RCE (CVE-2026-102490)

Exploits CVE-2026-102490 in FortiMail: unauthenticated path traversal and NULL-byte mishandling allows writing arbitrary files, enabling webshell deployment and remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """FortiMail unauthenticated path traversal RCE CVE-2026-102490.""" fro...

Hikvision Auth Bypass (CVE-2017-7921)

Exploits CVE-2017-7921 in multiple Hikvision cameras/NVRs: forged auth parameter grants access to deviceInfo and configuration download endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision auth bypass and config leak CVE-2017-7921.""" from kittysploit import from...

Honeywell PM43 Printer RCE (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 printers: newline injection in the username field of loadfile.lp login executes OS commands. !/usr/bin/env python3 -- coding: utf-8 -- """Honeywell PM43 loadfile command injection CVE-2023-3710.""" import re from kittysploit import from...

Linksys E2000 Auth Bypass (CVE-2024-27497)

Exploits CVE-2024-27497 in Linksys E2000 1.0.06: unauthenticated access to /position.js leaks sessionkey and admin interface paths. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E2000 position.js auth bypass CVE-2024-27497.""" from kittysploit import from lib.protocols.http.httpclient impo...

NETGEAR DGN syscmd RCE (CVE-2024-12847)

Exploits CVE-2024-12847 in NETGEAR DGN routers: unauthenticated command injection via setup.cgi todo=syscmd&cmd= parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR DGN setup.cgi syscmd RCE CVE-2024-12847.""" import re import urllib.parse from kittysploit import from...

Netis Router Info Disclosure (CVE-2024-48455)

Exploits CVE-2024-48455 in Netis WiFi routers: unauthenticated POST to skkget.cgi with modename/wllink leaks device stats and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Netis router skkget.cgi info disclosure CVE-2024-48455.""" from kittysploit import from...

Razer Sila Router LFI (CVE-2022-29014)

Exploits CVE-2022-29014 in Razer Sila 2.0.418: unauthenticated ubus JSON-RPC file.read on /ubus/ allows reading arbitrary files such as /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Razer Sila ubus file read LFI CVE-2022-29014.""" import json import re from kittysploit import from...

RomPager Misfortune Cookie Auth Bypass (CVE-2014-9222)

Exploits CVE-2014-9222 in Allegro RomPager: malformed C107373883 cookie bypasses authentication on embedded device admin interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager Misfortune Cookie auth bypass CVE-2014-9222.""" from kittysploit import from...

TBK DVR Auth Bypass (CVE-2018-9995)

Exploits CVE-2018-9995 in TBK/rebranded DVRs: Cookie uid=admin bypasses auth and /device.rsp?opt=user&cmd=list returns all user credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """TBK DVR cookie auth bypass credential leak CVE-2018-9995.""" import json from kittysploit import from...

Seagate NAS OS Info Disclosure (CVE-2018-12296)

Exploits CVE-2018-12296 in Seagate NAS OS 4.3.15.1: unauthenticated POST to system.System.getinfos returns firmware version and serial number. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS getinfos disclosure CVE-2018-12296.""" from kittysploit import from...

TOTOLINK A3002RU Credential Leak (CVE-2018-13317)

Exploits CVE-2018-13317 in TOTOLINK A3002RU 1.0.8: unauthenticated GET to /password.htm exposes plaintext admin username and password in JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3002RU password.htm leak CVE-2018-13317.""" import re from kittysploit import from...

TVT DVR Device Info Disclosure (CVE-2024-7339)

Exploits CVE-2024-7339 in TVT/Provision-ISR/AVISION DVRs: unauthenticated POST /queryDevInfo leaks firmware, network, and device metadata. !/usr/bin/env python3 -- coding: utf-8 -- """TVT DVR queryDevInfo disclosure CVE-2024-7339.""" from kittysploit import from lib.protocols.http.httpclient impo...

XiongMai uc-httpd Overflow (CVE-2018-10088)

Exploits CVE-2018-10088 in XiongMai uc-httpd 1.0.0 used in many IP cameras/DVRs: stack buffer overflow via oversized HTTP headers. Verifies uc-httpd surface and sends the canonical overflow trigger arch-specific shellcode may be required. !/usr/bin/env python3 -- coding: utf-8 -- """XiongMai...

Apache Struts2 S2-053 OGNL RCE (CVE-2017-12611)

Exploits CVE-2017-12611 S2-053 in Apache Struts 2 via Freemarker tag OGNL injection in the name parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-053 Freemarker OGNL RCE CVE-2017-12611.""" import re import urllib.parse from kittysploit import from...

Arista VeloCloud Orchestrator Auth Bypass (CVE-2026-93952)

Targets CVE-2026-93952 in on-prem VeloCloud Orchestrator VCO: when certificate-based Edge authentication is enabled, forged/absent cert checks may allow unauthenticated access to privileged portal and REST APIs. Probes internal API routes after portal fingerprinting. !/usr/bin/env python3 --...

Check Point Management Path Traversal RCE (CVE-2026-93616)

Exploits CVE-2026-93616 on Check Point Quantum Security Management: pre-authentication path traversal on TCP/19009 allows writing attacker-controlled content to reachable paths, enabling remote code execution on the SMS/Gaia host. !/usr/bin/env python3 -- coding: utf-8 -- """Check Point Quantum...

Cisco ASA Path Traversal LFI (CVE-2018-0296)

Exploits CVE-2018-0296 in Cisco ASA/FTD: directory traversal via +CSCOU+/.. paths exposes session listings and sensitive files without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco ASA/FTD path traversal LFI CVE-2018-0296.""" import json from kittysploit import from...

Cisco SD-WAN Manager Auth Bypass (CVE-2026-76504)

Exploits CVE-2026-76504 in Cisco Catalyst SD-WAN Manager: POST to a percent-encoded /jsecuritycheck path bypasses WildFly authentication constraints and yields an admin-level JSESSIONID, enabling full vManage API access and device template deployment. !/usr/bin/env python3 -- coding: utf-8 --...

Cisco Secure Email Gateway SQLi Chain (CVE-2026-76461)

Targets CVE-2026-76461 pre-authentication SQL injection in Cisco Secure Email Gateway AsyncOS email parsing. Confirms vulnerable AsyncOS builds via the management portal and documents SMTP-side exploitation TCP/25. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Email Gateway AsyncOS SQ...

Confluence Widget Connector SSTI (CVE-2019-3396)

Exploits CVE-2019-3396 in Confluence Server: Widget Connector macro template path traversal reads local files and enables Velocity SSTI RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Confluence Widget Connector SSTI / path traversal CVE-2019-3396.""" import json import re from kittysploit impo...

CKAN DataStore SQL Injection (CVE-2026-42031)

Exploits CVE-2026-42031 unauthenticated SQL injection in CKAN datastoresearchsql API via PostgreSQL tsrewrite primitives. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN datastoresearchsql unauth SQLi CVE-2026-42031.""" import json import urllib.parse from kittysploit import from...

GeoServer Jiffle WPS RCE (CVE-2022-24816)

Exploits CVE-2022-24816 in GeoServer via WPS ras:Jiffle: malicious Jiffle script is compiled through Janino into Java for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer Jiffle/Janino WPS RCE CVE-2022-24816.""" import re from kittysploit import from...

GitLab Commits API file.path LFI (CVE-2026-85706)

Exploits CVE-2026-85706 in self-managed GitLab CE/EE: unauthenticated multipart POST to /api/v4/projects/id/repository/commits with attacker-controlled file.path reads arbitrary host files outside Workhorse temp directories. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab unauthenticated...

GitLab ExifTool DjVu RCE (CVE-2021-22205)

Exploits CVE-2021-22205 in GitLab CE/EE: malformed DjVu metadata embedded in a JPEG upload triggers ExifTool Perl injection during image processing. Delivers a reverse shell via the configured payload or runs verifycmd in-band when possible. !/usr/bin/env python3 -- coding: utf-8 -- """GitLab...

JFrog Artifactory Join-Key Admin RCE (CVE-2026-82329)

Exploits CVE-2026-82329 in JFrog Artifactory: default blank cluster join key allows forging an HS256 JWT and obtaining admin access via POST /access/api/v1/registry/join, then executes commands through the system API. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory blank join-key...

LiteLLM MCP Auth Bypass RCE (CVE-2026-59822)

Exploits CVE-2026-59822 in LiteLLM proxy before 1.84.0: forged Bearer token bypasses MCP Streamable HTTP auth, then invokes an MCP tool or admin route to execute the configured reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM MCP auth bypass to RCE CVE-2026-59822.""" impo...

MajorDoMo Admin Console RCE (CVE-2026-27174)

Exploits CVE-2026-27174 in MajorDoMo: unauthenticated access to the admin PHP console via /admin.php?ajaxpanel=1&op=console&command= allows arbitrary PHP/code execution. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo unauthenticated admin console PHP execution CVE-2026-27174.""" import re...

Sonatype Nexus Jexl RCE (CVE-2019-7238)

Exploits CVE-2019-7238 in Nexus Repository Manager 3.15.0: missing ACL on /service/extdirect previewAssets allows Jexl expression remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Sonatype Nexus Repository Manager Jexl RCE CVE-2019-7238.""" import json import re from kittysploit...

OpenAM Pre-Auth Deserialization RCE (CVE-2026-33439)

Exploits CVE-2026-33439 in OpenAM = 16.0.5: unsafe Java deserialization of jato.clientSession on password reset endpoints bypasses the WhitelistObjectInputStream mitigation applied to jato.pageSession. !/usr/bin/env python3 -- coding: utf-8 -- """OpenAM jato.clientSession deserialization RCE...

Palo Alto GlobalProtect Command Injection (CVE-2024-3400)

Exploits CVE-2024-3400 in PAN-OS GlobalProtect: SESSID path traversal writes into devicetelemetry cron directories, yielding root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect PAN-OS command injection CVE-2024-3400.""" import secrets import time from...

Spring4Shell RCE (CVE-2022-22965)

Exploits CVE-2022-22965 Spring Framework classLoader parameter binding to write a JSP webshell via Tomcat access log manipulation, then executes the configured reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring4Shell parameter binding RCE CVE-2022-22965.""" import random...

TeamCity Auth Bypass Admin Creation (CVE-2024-27198)

Exploits CVE-2024-27198 in JetBrains TeamCity: alternate servlet path /hax?jsp=/app/rest/... bypasses authentication to create an administrator account via the REST users API. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity authentication bypass admin creation CVE-2024-27198."""...

Apache Struts2 S2-061 RCE (CVE-2020-17530)

Exploits CVE-2020-17530 S2-061 in Apache Struts 2.0.0–2.5.25: forced OGNL evaluation in tag attributes yields remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 S2-061 forced OGNL RCE CVE-2020-17530.""" import re import urllib.parse from kittysploit import from...

WP Download Manager Shortcode RCE (CVE-2024-11740)

Exploits CVE-2024-11740 in WordPress Download Manager 3.3.04: unauthenticated arbitrary shortcode execution via wpdmxp query parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Download Manager shortcode execution CVE-2024-11740.""" from kittysploit import from...

XWiki SolrSearch Groovy RCE (CVE-2025-24893)

Exploits CVE-2025-24893 in XWiki Platform: unauthenticated Groovy execution via crafted text parameter on /bin/get/Main/SolrSearch. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki SolrSearch Groovy RCE CVE-2025-24893.""" import re import urllib.parse from kittysploit import from...