Huawei Router HG532 RCE

Module exploits remote command execution in Huawei Router HG532 devices. If the target is vulnerable, command loop is invoked that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Router HG532 RCE""" from kittysploit import from...

Zyxel P660HN-T v2 RCE

Remote command execution in Zyxel P660HN-T V2 devices via blind command injection in log settings commands up to 28 characters. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel P660HN-T v2 RCE""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

ZTE ZXV10 RCE

Exploits ZTE ZXV10 H108L remote code execution vulnerability that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """ZTE ZXV10 RCE""" import re import time from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Daemonize / Hide Console (PowerShell)

Hide console window and lower process priority before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize / Hide Console PowerShell", "description": "Hide console window an...

Extract Embedded ZIP (PowerShell)

Extract a ZIP archive embedded at generation time before callback !/usr/bin/env python3 -- coding: utf-8 -- """Extract an embedded ZIP archive before callback PowerShell emitter.""" from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.emitters.powershell impor...

Netsys Multi RCE

Exploits Netsys multiple remote command execution vulnerabilities that allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """Netsys Multi RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

TP-Link WDR740ND/WDR740N - Debug Backdoor RCE

Exploits the hidden debug endpoint /userRpm/DebugResultRpm.htm osteam/5up backdoor credentials to run shell commands as root. !/usr/bin/env python3 -- coding: utf-8 -- import re from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Belkin G Info Disclosure

Module exploits Belkin Wireless G Plus MIMO Router F5D9230-4 information disclosure vulnerability which allows fetching sensitive information such as credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin G Info Disclosure""" import re from kittysploit import from...

Belkin G & N150 Password Disclosure

Module exploits Belkin G and N150 Password MD5 Disclosure vulnerability which allows fetching administration's password in md5 format !/usr/bin/env python3 -- coding: utf-8 -- """Belkin G & N150 Password Disclosure""" import re from kittysploit import from lib.protocols.http.httpclient import...

Belkin N150 Path Traversal

Module exploits Belkin N150 Path Traversal vulnerability which allows to read any file on the system. !/usr/bin/env python3 -- coding: utf-8 -- """Belkin N150 Path Traversal""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleAuxiliary, Httpclient...

D-Link PingTest RCE

Module exploits unauthenticated remote code execution occurs in D-Link products such as DIR-655C, DIR-866L, DIR-652, and DHP-1565. The issue occurs when the attacker sends an arbitrary input to a "PingTest" device common gateway interface that could lead to common injection. An attacker who...

webpack-dev-server CVE-2026-14620 open-editor CSRF check

CVE-2026-14620 GHSA-f5vj-f2hx-8m93: webpack-dev-server = 5.2.5 allows cross-site requests to GET /webpack-dev-server/open-editor?fileName=, which calls launchEditor and can spawn an editor on an attacker-chosen path. The CVE-2026-6402 guard only blocks no-cors subresources; cross-site navigations...

webpack-dev-server CVE-2026-14620 open-editor CSRF detect

Detects CVE-2026-14620 in webpack-dev-server = 5.2.5: cross-site GET /webpack-dev-server/open-editor?fileName= reaches launchEditor. Probes cors and no-cors Sec-Fetch combinations; vulnerable when cors cross-site returns HTTP 200 while no-cors cross-site is blocked 403. !/usr/bin/env python3 --...

D-Link DNS NAS CVE-2024-10914 account_mgr.cgi RCE detect

Detects CVE-2024-10914 in D-Link ShareCenter NAS devices: unauthenticated command injection via /cgi-bin/accountmgr.cgi?cmd=cgiuseradd&name= DNS-320, DNS-320LW, DNS-325, DNS-340L and related EOL models. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2024-10914 — D-Link DNS NAS accountmgr.cgi...

Payment Gateway PIX for WooCommerce <= 1.5.0 - Unauthenticated Upload RCE (CVE-2026-3891)

CVE-2026-3891 in Payment Gateway PIX for WooCommerce = 1.5.0: unauthenticated arbitrary file upload via admin-ajax.php lknpixforwoocommercec6savesettings. An attacker obtains a nonce from lknpixforwoocommercegeneratenonce, uploads a PHP webshell as certificatecrtpath, and executes code under...

Payment Gateway PIX for WooCommerce CVE-2026-3891 upload detect

Detects CVE-2026-3891 in Payment Gateway PIX for WooCommerce = 1.5.0: unauthenticated nonce generation via admin-ajax.php indicates exposure to certificatecrtpath arbitrary file upload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-3891 — Payment Gateway PIX for WooCommerce unauthenticate...

ipTIME EAD UDP Service Detection (56026)

Detects ipTIME routers exposing the EAD UDP service on port 56026. On affected firmware e.g. A3004T 14.19.0, this endpoint is reachable without authentication and is associated with pre-auth command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect ipTIME EAD UDP service port 56026...

D-Link DNS NAS - account_mgr.cgi RCE (CVE-2024-10914)

CVE-2024-10914: unauthenticated OS command injection in /cgi-bin/accountmgr.cgi cmd=cgiuseradd. The name parameter is concatenated into system without sanitisation. Affects EOL models including DNS-320, DNS-320LW, DNS-325, and DNS-340L. Command output is returned in the HTTP response. Opens an...

ipTIME A3004T EAD Service - Pre-auth RCE (UDP/56026)

Pre-authentication remote command execution in ipTIME A3004T firmware 14.19.0 OpenWrt / MediaTek MT7621. The EAD service binds to UDP/56026 without source-IP filtering; EADTYPESENDCMD 0x0a reaches system in handlesendcmd. Opens a reverse shell session default payload or a blind UDP execute sessio...

Blocksy Companion <= 2.1.46 - Unauthenticated File Upload RCE (CVE-2026-58480)

CVE-2026-58480: unauthenticated arbitrary file upload via blc-review-images in blcsavereviewattachments. Double-extension bypass .woff2.php when Advanced Reviews and Custom Fonts are enabled. Fixed in 2.1.47. !/usr/bin/env python3 -- coding: utf-8 -- from future import annotations import json...

Windows Admin Center - Authenticated PowerShell RCE (CVE-2026-26119)

CVE-2026-26119: authenticated RCE via WinREST/PowerShell invokeCommand. Use a reversetcp payload; the framework listener creates the shell session. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-26119 — Windows Admin Center authenticated WinREST/PowerShell RCE.""" from future import...

mcp-server-kubernetes < 3.9.0 - Argument Injection (CVE-2026-61459)

CVE-2026-61459: argument injection in kubectlget, kubectldescribe, and kubectldelete via resourceType/name parameters. Starts a local fake Kubernetes API callback server, injects --server= into the MCP tool call, captures the bearer token from kubectl, and optionally registers a Kubernetes sessio...

Planyo Online Reservation System <= 3.0 - Arbitrary File Read (CVE-2026-3576)

CVE-2026-3576 in Planyo Online Reservation System . !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-3576 — Planyo Online Reservation System arbitrary file read via file:// SSRF.""" from future import annotations from urllib.parse import urlencode from kittysploit import from...

Orkes Conductor / Conductor OSS < 3.30.2 - Unauthenticated RCE (CVE-2026-58138)

CVE-2026-58138: Conductor OSS and Orkes Conductor versions below 3.30.2 allow unauthenticated remote code execution by registering a workflow with a malicious INLINE JavaScript task that abuses unsandboxed GraalVM HostAccess.ALL for Java reflection and Runtime.exec. !/usr/bin/env python3 -- codin...

Orkes Conductor CVE-2026-58138 (unauthenticated RCE) detection

Detects Conductor OSS / Orkes Conductor instances running a version below 3.30.2 that may be vulnerable to CVE-2026-58138 unauthenticated INLINE JavaScript RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Orkes Conductor / Conductor OSS instances vulnerable to CVE-2026-58138.""" from futu...

Microsoft Edge V8 Type Confusion RCE (CVE-2026-58289)

CVE-2026-58289 for Edge Chromium before 150.0.4078.48. chainmode=probe injects the public PoC into a browserserver session no listener. chainmode=full runs a research chain: 58289 heap layout → Maglev fake object → addrof/fakeobj → WASM shellcode via self.payload. Full chain needs Edge with...

Metabase reset_password SQLi Admin Takeover (GHSA-vwf4-m7j8-wcjf)

GHSA-vwf4-m7j8-wcjf in Metabase = v0.58.0 before the x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 patches: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key. On all backends, injecting a subquery that resolves to the admin...

Metabase reset_password SQLi (GHSA-vwf4-m7j8-wcjf)

Detects Metabase = v0.58.0 before x.58.24 / x.59.21 / x.60.17 / x.61.11 / x.62.9 / x.63.5 affected by GHSA-vwf4-m7j8-wcjf: pre-authentication SQL injection in POST /api/session/resetpassword via HoneySQL raw-map in the user-id JSON key mass parameter pollution. !/usr/bin/env python3 -- coding:...

Kyocera M2035dn Pre-Auth LFI File Read

Reads arbitrary files from Kyocera Command Center RX ECOSYS M2035dn printers via /js/ traversal with a .jpg null suffix. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera Command Center RX ECOSYS M2035dn pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient impo...

JetBrains TeamCity Agent Polling RCE (CVE-2026-63077)

Exploits CVE-2026-63077 in JetBrains TeamCity: unauthenticated agent registration followed by XStream deserialization on /app/agents/v1/commands/error. The gadget chain writes a one-shot .jspws terminal under the TeamCity webroot and executes an OS command via Runtime.exec. Success is confirmed b...

C-Lodop Printer Pre-Auth File Read

Reads arbitrary files from C-Lodop print servers using encoded directory traversal in the HTTP URL. !/usr/bin/env python3 -- coding: utf-8 -- """C-Lodop printer pre-auth arbitrary file read via URL path traversal.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient fro...

PaperCut NG/MF Auth Bypass RCE (CVE-2023-27350)

Exploits CVE-2023-27350 in PaperCut NG/MF before 20.1.7, 21.2.11, and 22.0.9. Unauthenticated access to SetupCompleted grants an admin session, then Rhino print scripting runs self.payload via java.lang.ProcessBuilder. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-27350 — PaperCut NG/MF...

Xerox EFI Fiery Webtools LFI File Read

Reads arbitrary files via forceSave.php on Xerox DC260 EFI Fiery Controller Webtools 2.0. !/usr/bin/env python3 -- coding: utf-8 -- """Xerox EFI Fiery Controller Webtools forceSave.php pre-auth LFI file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Sharp MFP Pre-Auth LFI File Read

Reads arbitrary files from Sharp multifunction printers via installedemanualdown.html. Pairs with scanner/http/sharpprinterslfidetect. !/usr/bin/env python3 -- coding: utf-8 -- """Sharp MFP pre-auth local file inclusion — arbitrary file read.""" from kittysploit import from...

JetDirect / PJL Service Detection (port 9100)

Detects network printers exposing raw JetDirect/AppSocket on TCP 9100 and probes the PJL command interface with INFO ID. Optionally checks whether FSUPLOAD path traversal returns /etc/passwd content. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HP JetDirect / AppSocket raw printing and PJL...

HP JetDirect PJL Filesystem Read (port 9100)

Reads files and lists directories on network printers exposing raw JetDirect/AppSocket on TCP 9100 via PJL FSUPLOAD/FSDIRLIST. !/usr/bin/env python3 -- coding: utf-8 -- """HP JetDirect / raw printing port 9100 PJL filesystem read and listing.""" import socket from typing import Optional from...

PaperCut Path Traversal File Read (CVE-2023-39143)

Reads files from unpatched PaperCut NG/MF on Windows 22.1.3 via CustomReportExample path traversal. Optional WebDAV COPY stages unreadable paths into data/scan/webdav before download. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-39143 — PaperCut NG/MF Windows path traversal file read."""...

Honeywell PM43 Command Injection (CVE-2023-3710)

Exploits CVE-2023-3710 in Honeywell PM43 industrial printers before firmware P10.19.050004: newline injection in loadfile.lp Configure runs self.payload as the embedded Linux user. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2023-3710 — Honeywell PM43 printer unauthenticated command...

osCommerce - templates_modules LFI Detection (CVE-2011-4543)

Detects CVE-2011-4543 via info.php?set=../../../../etc/passwd%00. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4543 via info.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'osCommerce -...

Vacron NVR - board.cgi Command Injection (CVE-2025-34043)

Exploits unauthenticated OS command injection via Vacron /board.cgi?cmd=. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Vacron NVR board.cgi RCE CVE-2025-34043 — opens execute session.""" import re from urllib.parse import quote from kittysploit import from...

Amcrest IP Camera - webCapsConfig Information Disclosure (CVE-2024-12984)

Amcrest IP cameras expose /webcaps/webCapsConfig without authentication, disclosing deviceType and WebVersion metadata. !/usr/bin/env python3 -- coding: utf-8 -- """Amcrest IP camera webCapsConfig information disclosure CVE-2024-12984.""" from kittysploit import from lib.protocols.http.httpclient...

Apache Axis2 - xsd Path Traversal Detection

Detects Axis2 service ?xsd=../conf/axis2.xml traversal by matching axisconfig AxisJava2.0 in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Axis2 ?xsd= path traversal to axis2.xml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Beward IP Camera - servetest NTP Command Injection (CVE-2025-34042)

Exploits Beward camera command injection in ServerName of /cgi-bin/operator/servetest?cmd=ntp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Beward IP camera servetest NTP RCE — opens execute session.""" import re from urllib.parse import quote from kittysploi...

eXtplorer - password[] Auth Bypass Detection

Detects eXtplorer auth bypass via password= empty array login as admin. !/usr/bin/env python3 -- coding: utf-8 -- """eXtplorer password authentication bypass.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eXtplorer...

Huawei HG659 - /lib/ Path Traversal Detection

Detects directory traversal on Huawei HG659 via GET /lib/....//....//etc/passwd Greenbone Jun 2021 active check. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG659 /lib/ path traversal file read.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

phpThumb - fltr Command Injection Detection (CVE-2010-1598)

Detects CVE-2010-1598 by injecting ;id; into phpThumb.php fltr=blur|... !/usr/bin/env python3 -- coding: utf-8 -- """phpThumb fltr command injection CVE-2010-1598.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

ARRIS Router - Arbitrary File Read Detection (CVE-2022-31793)

Multiple ARRIS routers expose arbitrary files via GET /a/ without authentication CVE-2022-31793. !/usr/bin/env python3 -- coding: utf-8 -- """ARRIS router arbitrary file read via /a/ CVE-2022-31793.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HomeMatic CCU2 - TCL RCE (CVE-2018-7297)

Exploits unauthenticated TCL system.Exec via /Text.exe on HomeMatic CCU2. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """HomeMatic CCU2 TCL interpreter RCE CVE-2018-7297 — opens execute session.""" import re from kittysploit import from...

vsftpd - Compromised Package Backdoor Detection (CVE-2011-2523)

Detects CVE-2011-2523 by sending USER X: / PASS X then checking for a shell on TCP/6200 that responds to id. !/usr/bin/env python3 -- coding: utf-8 -- """vsftpd 2.3.4 backdoor CVE-2011-2523.""" import re import socket import time from kittysploit import from lib.protocols.tcp.tcpscannerclient...

rConfig - commands.inc.php SQLi Detection (CVE-2020-10220)

Detects CVE-2020-10220 by injecting UNION SELECT of a marker into commands.inc.php searchColumn and looking for id="" in the response. !/usr/bin/env python3 -- coding: utf-8 -- """rConfig commands.inc.php SQL injection CVE-2020-10220.""" from kittysploit import from lib.protocols.http.httpclient...