SonicWall SMA 1000 pre-auth storedCommunity RCE chain

Filter bypass, enable CMS, apply changes, SSO token, session id, POST configUserCommunityEPC.do with base64 Java gadget set storedcommunityb64. """SonicWall SMA 1000 pre-auth deserialization chain storedCommunity delivery.""" from future import annotations import json import time from kittysploit...

Telaeris XPressEntry unauthenticated SQLi RCE

Unauthenticated POST /activities injects stacked T-SQL via sNotes to enable xpcmdshell and run attacker commands on the backend SQL Server. !/usr/bin/env python3 -- coding: utf-8 -- """Telaeris XPressEntry unauthenticated SQL injection to xpcmdshell.""" from future import annotations import uuid...

Accurate Online Hessian JNDI RCE

Hessian startAwsS3Emigrate + Spring JNDI gadget; local LDAP/HTTP serve Exploit.class bind via lhost. """Accurate Online Private Cloud — Unauthenticated Hessian Deserialization JNDI RCE""" from future import annotations from kittysploit import from http.server import BaseHTTPRequestHandler,...

AOMEI Cyber Backup Thrift NAS mount injection RCE

AddBackupStorageNAS + DeleteBackupStorage: NAS username quote-break into CNasHelper mount system ports 9074/9078. """AOMEI Cyber Backup Unauthenticated Thrift NAS Mount Injection RCE""" from future import annotations from kittysploit import import os import socket import struct import sys import...

Acumatica Customization Publish Webshell RCE — Detect

Fingerprint / reachability check for Acumatica Customization Publish Webshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Acumatica Customization Publish Webshell RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE — Detect

Fingerprint / reachability check for atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE""" from kittysploit import from lib.protocols.http.httpclient impor...

CaptureBites MetaServer — Unauthenticated SYSTEM RCE Through the Workflow RunPro — Detect

Fingerprint / reachability check for CaptureBites MetaServer — Unauthenticated SYSTEM RCE Through the Workflow RunProgram Sink !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CaptureBites MetaServer — Unauthenticated SYSTEM RCE Through the Workflow RunProgram Sink""" from kittysploit...

Cisco CUCM Remote Code Execution Chain — Detect

Fingerprint / reachability check for Cisco CUCM Remote Code Execution Chain !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Cisco CUCM Remote Code Execution Chain""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

InterSystems IRIS FolderManager Property Injection RCE — Detect

Fingerprint / reachability check for InterSystems IRIS FolderManager Property Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for InterSystems IRIS FolderManager Property Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Joget Workflow Enterprise JasperReports jrxml Expression Injection RCE — Detect

Fingerprint / reachability check for Joget Workflow Enterprise JasperReports jrxml Expression Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Joget Workflow Enterprise JasperReports jrxml Expression Injection RCE""" from kittysploit import from lib.protocols.http.httpclie...

Lightstreamer Server 7.4.8 — Unauthenticated JMX `jvmtiAgentLoad` Native Code Ex — Detect

Fingerprint / reachability check for Lightstreamer Server 7.4.8 — Unauthenticated JMX jvmtiAgentLoad Native Code Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lightstreamer Server 7.4.8 — Unauthenticated JMX jvmtiAgentLoad Native Code Execution""" from kittysploit import fr...

LogicalDOC Enterprise — Automation Scripting Sandbox-Bypass RCE — Detect

Fingerprint / reachability check for LogicalDOC Enterprise — Automation Scripting Sandbox-Bypass RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for LogicalDOC Enterprise — Automation Scripting Sandbox-Bypass RCE""" from kittysploit import from lib.protocols.http.httpclient import...

Maian Gallery — Authenticated Admin RCE via Unrestricted File Upload (upload_thu — Detect

Fingerprint / reachability check for Maian Gallery — Authenticated Admin RCE via Unrestricted File Upload uploadthumbnail !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Maian Gallery — Authenticated Admin RCE via Unrestricted File Upload uploadthumbnail""" from kittysploit import from...

NCache Enterprise — Unauthenticated Assembly.LoadFrom RCE via Web Manager — Detect

Fingerprint / reachability check for NCache Enterprise — Unauthenticated Assembly.LoadFrom RCE via Web Manager !/usr/bin/env python3 -- coding: utf-8 -- """Detection for NCache Enterprise — Unauthenticated Assembly.LoadFrom RCE via Web Manager""" from kittysploit import from...

SmartBear Collaborator Server 15.1.15101 - Path Traversal (Zip-Slip) in the DOOR — Detect

Fingerprint / reachability check for SmartBear Collaborator Server 15.1.15101 - Path Traversal Zip-Slip in the DOORS/Simulink Review-File Upload Leading to Groovy Server Page Execution CWE-22 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for SmartBear Collaborator Server 15.1.15101 - Pat...

RoboTask REST API Unauthenticated Remote Task Execution (CWE-306) — Detect

Fingerprint / reachability check for RoboTask REST API Unauthenticated Remote Task Execution CWE-306 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RoboTask REST API Unauthenticated Remote Task Execution CWE-306""" from kittysploit import from lib.protocols.http.httpclient import...

Opengear NGCS Firmware 25.11.8 — PDU `name` Command Injection (Authenticated Adm — Detect

Fingerprint / reachability check for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Opengear NGCS Firmware 25.11.8 — PDU name Command Injection Authenticated Administrator to Root R"""...

Docmosis Tornado Unauthenticated Arbitrary File Write to Root RCE (storeTo=file: — Detect

Fingerprint / reachability check for Docmosis Tornado Unauthenticated Arbitrary File Write to Root RCE storeTo=file: → cron !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Docmosis Tornado Unauthenticated Arbitrary File Write to Root RCE storeTo=file: → cron""" from kittysploit import...

Stimulsoft Server Unauthenticated Report Script RCE — Detect

Fingerprint / reachability check for Stimulsoft Server Unauthenticated Report Script RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Stimulsoft Server Unauthenticated Report Script RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Telaeris XPressEntry Unauthenticated SQL Injection RCE — Detect

Fingerprint / reachability check for Telaeris XPressEntry Unauthenticated SQL Injection RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Telaeris XPressEntry Unauthenticated SQL Injection RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Lightstreamer Server 7.4.8 (build 3506 ENTERPRISE) — Shipped Placeholder JMX/RMI Credentials plus MLet Remote Class Load

Lightstreamer Server 7.4.8 build 3506 ENTERPRISE — Shipped Placeholder JMX/RMI Credentials plus MLet Remote Class Loading Yield root RCE """Lightstreamer Server 7.4.8 build 3506 ENTERPRISE — Shipped Placeholder JMX/RMI Credentials plus MLet Remote Class Loading Yield root RCE""" from future impor...

Asustor ADM music.cgi act=live command injection RCE

Login → upload malicious .mp3 filename → act=add → act=live triggers ffmpeg -i "..." shell breakout command in filename. """Asustor ADM music.cgi act=live authenticated command injection RCE.""" from future import annotations import json import re import uuid from urllib.parse import urlencode fr...

Kerio Connect Server.startEncryption Command Injection Authenticated RCE — Detect

Fingerprint / reachability check for Kerio Connect Server.startEncryption Command Injection Authenticated RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Kerio Connect Server.startEncryption Command Injection Authenticated RCE""" from kittysploit import from...

ITRS OP5 Monitor command_test.php patch bypass RCE

Authenticated monitor/monitor → CSRF → commandtest.php $ injection with base64 output retrieval. !/usr/bin/env python3 -- coding: utf-8 -- """ITRS OP5 Monitor commandtest.php authenticated command injection RCE.""" from future import annotations import base64 import re from urllib.parse import...

Lantronix EDS3000PR SSL passin command injection

Authenticated POST /ssl with certpasswd/keypasswd injected into openssl -passin pass:%s system enables root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Lantronix EDS SSL -passin pass:%s command injection RCE.""" from future import annotations import re import time from...

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained — Detect

Fingerprint / reachability check for Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor Application CWE-306, CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Titan MFT Server 26.0.0 - Unauthenticate...

RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE — Detect

Fingerprint / reachability check for RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE""" from kittysploit import from...

Wyn Enterprise Unauthenticated Root RCE (Token Forgery + Zip-Slip + Provider Loa — Detect

Fingerprint / reachability check for Wyn Enterprise Unauthenticated Root RCE Token Forgery + Zip-Slip + Provider Load !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Wyn Enterprise Unauthenticated Root RCE Token Forgery + Zip-Slip + Provider Load""" from kittysploit import from...

MAPS SCADA WSDataProvider.Login Unauthenticated BinaryFormatter Deserialization — Detect

Fingerprint / reachability check for MAPS SCADA WSDataProvider.Login Unauthenticated BinaryFormatter Deserialization RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for MAPS SCADA WSDataProvider.Login Unauthenticated BinaryFormatter Deserialization RCE""" from kittysploit import from...

Cinegy Cinegize Unauthenticated BinaryFormatter Deserialization RCE

Cinegy Cinegize Unauthenticated BinaryFormatter Deserialization RCE """Cinegy Cinegize Unauthenticated BinaryFormatter Deserialization RCE""" from future import annotations from kittysploit import import socket, struct, base64, subprocess, sys, time, os import struct import time import re import...

iMonnit Express unauth plugin load SYSTEM RCE

CheckAnswer auth bypass → Gateway/CertUpload path traversal → ConfigurePlugin loads DLL from C:\Windows\Temp. !/usr/bin/env python3 -- coding: utf-8 -- """iMonnit Express CheckAnswer bypass CertUpload traversal plugin SYSTEM RCE.""" from future import annotations import hashlib import time import...

KeyHelp Apache ErrorLog pipe directive root RCE

Authenticated admin injects apachehttpdirectives ErrorLog pipe; KeyHelp cron renders vhost and Apache reload runs command as root. !/usr/bin/env python3 -- coding: utf-8 -- """KeyHelp authenticated Apache ErrorLog pipe directive root RCE.""" from future import annotations import os import re impo...

Synametrics Syncrify 6.2 build 1178 - Path Traversal in the PublicLink Chunk-Upl — Detect

Fingerprint / reachability check for Synametrics Syncrify 6.2 build 1178 - Path Traversal in the PublicLink Chunk-Upload Branch CWE-22 Leading to Root Command Execution !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Synametrics Syncrify 6.2 build 1178 - Path Traversal in the PublicLin...

ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE — Detect

Fingerprint / reachability check for ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for ZesleCP — Authenticated Arbitrary File Write → Cron → Root RCE""" from kittysploit import from lib.protocols.http.httpclient import...

TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reachi — Detect

Fingerprint / reachability check for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Server Address Reaching Root Execution Through a Shell-Form system Call CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for TRENDnet TV-IP302PI 1.02.38 - Command Injection in the NTP Serv...

Software AG webMethods MSR — XSLT Xalan Java-Extension RCE (Default Credentials) — Detect

Fingerprint / reachability check for Software AG webMethods MSR — XSLT Xalan Java-Extension RCE Default Credentials !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Software AG webMethods MSR — XSLT Xalan Java-Extension RCE Default Credentials""" from kittysploit import from...

Abyss Web Server first-run console takeover log-as-CGI RCE

First-run console credential creation, bind access log as /bin/sh CGI, smuggle command via User-Agent, trigger via log URI fetch. """Abyss Web Server X1 2.16.22.0 - Missing Authentication for Console Credential Creation Reaching a Configuration-Write to Log-as-CGI Command Execution Chain CWE-306,...

Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE

Unauthenticated POST to /pbx/gate?bean=web.XmlTransBean with a crafted XmlTransBean payload reaches com.brekeke.util.Util.execString and runs arbitrary commands via sh -c. !/usr/bin/env python3 -- coding: utf-8 -- """Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE""" from future import...

CatDV aaftoolPath authenticated root RCE

Login to CatDV web API, PUT server-config aaftoolPath, trigger AAF export. Place the script on the host via sshkey or pre-stage at aaftoolpath. """CatDV authenticated aaftoolPath override → AAF export root RCE.""" from future import annotations import base64 import json import os import re import...

Altus iX Developer XAML gadget screen RCE

Builds malicious .ix / .ixp with ObjectDataProvider→Process.Start from set payload. Operator opens the file in iX Developer local trigger, not network delivery. """Altus iX Developer XAML Deserialization RCE""" from future import annotations import os import tempfile from kittysploit import impor...

atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE

atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE """atvise SCADA OPC UA Authentication Bypass Unauthenticated Root RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient import sys, os, json, random, hashlib,...

CaptureBites MetaServer unauth RunProgram workflow RCE

Anonymous SOAP chain CreateWorkflow → UploadDefinition RunPrograms → ChangeWorkflows → CreateDocument triggers cmd.exe as SYSTEM. """CaptureBites MetaServer — Unauthenticated SYSTEM RCE Through the Workflow RunProgram Sink""" from future import annotations import base64 import http.client import...

VitalPBX asterisk_cli System() root RCE

Authenticated admin POST index.php asteriskcli runCommand adds dialplan System extension and originates a call to run as root. !/usr/bin/env python3 -- coding: utf-8 -- """VitalPBX asteriskcli dialplan System root privilege escalation.""" from future import annotations import json import re impor...

SmartBear Collaborator DOORS review upload Zip-Slip GSP RCE

Authenticated JSON login + DOORS review archive upload; Zip-Slip drops Groovy server page under Tomcat ROOT. """SmartBear Collaborator DOORS review Zip-Slip Groovy GSP RCE.""" from future import annotations import io import json import uuid import zipfile from kittysploit import from...

GigaSpaces XAP Unauthenticated Path Traversal to Root RCE — Detect

Fingerprint / reachability check for GigaSpaces XAP Unauthenticated Path Traversal to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for GigaSpaces XAP Unauthenticated Path Traversal to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

CIRCUTOR PowerStudio JWT alg=none forgery

Forge alg=none Admin JWT and access protected admin/microservice routes. When events.xml accepts the token, delivers shellExecute for Windows cmd/payload. """CIRCUTOR PowerStudio JWT alg=none admin forgery auth bypass chain primitive.""" from future import annotations import base64 import json...

MidVision RapidDeploy Remote Agent Unauthenticated Arbitrary File Write RCE

MidVision RapidDeploy Remote Agent Unauthenticated Arbitrary File Write RCE """MidVision RapidDeploy Remote Agent Unauthenticated Arbitrary File Write RCE""" from future import annotations from kittysploit import import base64 import os import subprocess import sys import tempfile import textwrap...

SmarterMail — Antivirus Command-Line Configuration → RCE as NT AUTHORITY\SYSTEM — Detect

Fingerprint / reachability check for SmarterMail — Antivirus Command-Line Configuration → RCE as NT AUTHORITY\SYSTEM !/usr/bin/env python3 -- coding: utf-8 -- r"""Detection for SmarterMail — Antivirus Command-Line Configuration → RCE as NT AUTHORITY\SYSTEM""" from kittysploit import from...

CatDV Server Authenticated aaftoolPath Root RCE — Detect

Fingerprint / reachability check for CatDV Server Authenticated aaftoolPath Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CatDV Server Authenticated aaftoolPath Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

RTS VLink OpenSSL -engine UNC injection SYSTEM RCE

Authenticated POST /api/v1/ssl/generatetlsclientcertificate with PASSWORD argument injection; WebDAV on LHOST:LPORT serves PoC DLL evil64.dll.b64. """RTS Intercom VLink Virtual Matrix — OpenSSL Argument Injection → SYSTEM RCE""" from future import annotations from kittysploit import from...