Certifried AD CS Machine Certificate Spoofing (CVE-2022-26923)

Exploits CVE-2022-26923: creates a machine account, clears its SPN, sets dNSHostName to match a domain controller, then enrolls an AD CS Machine template certificate via NTLM web enrollment. The resulting certificate may authenticate as the spoofed DC via PKINIT. !/usr/bin/env python3 -- coding:...

WinRAR Path Traversal (CVE-2025-8088)

Generates a malicious RAR archive exploiting CVE-2025-8088 path traversal in WinRAR = 7.11. When extracted, payload is written to the Windows Startup folder for code execution on next login. User interaction required. !/usr/bin/env python3 -- coding: utf-8 -- """WinRAR path traversal code executi...

Microsoft IIS HTTP.sys Range RCE (CVE-2015-1635)

Exploits CVE-2015-1635 MS15-034 in HTTP.sys on IIS 8.x: crafted Range headers trigger integer overflow enabling remote code execution or DoS. This module verifies the vulnerable code path and sends the canonical overlapping-range trigger used by public PoCs. !/usr/bin/env python3 -- coding: utf-8...

SharePoint ToolPane Register Injection RCE (CVE-2026-65660)

Exploits CVE-2026-65660 in Microsoft SharePoint: unescaped quotes in MSOTlPnDWP Register directive reconstruction allow injecting additional directives and XamlServices.Parse gadget chains via AddGallery/ToolPane endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolPane Register...

SharePoint ToolShell RCE (CVE-2025-53770)

Exploits the SharePoint ToolShell chain: Referer bypass to reach ToolPane.aspx CVE-2025-53771 then unsafe ViewState deserialization for unauthenticated RCE CVE-2025-53770 on on-premises SharePoint. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint ToolShell unauthenticated RCE CVE-2025-5377...

noPac SamAccountName Spoofing Domain Escalation (CVE-2021-42278/42287)

Chains CVE-2021-42278 sAMAccountName spoofing on computer accounts with CVE-2021-42287 Kerberos PAC confusion to obtain a forwardable service ticket for a privileged user via S4U2Self/S4U2Proxy. Requires an authenticated domain user with ms-DS-MachineAccountQuota and LDAPS for machine password se...

Zammad Local Privilege Escalation (CVE-2026-102490)

Post-exploitation module for CVE-2026-102490: escalates from the zammad service user to root on Zammad installations when a writable sudoers drop-in, cron job, or package hook is abusable. Intended as the second stage after CVE-2026-102489 session fixation RCE. !/usr/bin/env python3 -- coding:...

FortiMail CVE-2026-102490 Detection

Detects FortiMail instances vulnerable to CVE-2026-102490 unauthenticated path traversal allowing arbitrary file write via crafted HTTP requests. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiMail path traversal CVE-2026-102490.""" from kittysploit import from...

MOVEit Transfer CVE-2023-34362 Detect

Detects Progress MOVEit Transfer instances exposing the CVE-2023-34362 attack surface: /moveitisapi/moveitisapi.dll?action=m2 header-smuggling path and guestaccess.aspx guest session workflow. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Progress MOVEit Transfer CVE-2023-34362 SQLi...

LiteSpeed cPanel Plugin CVE-2026-48172 Detection

Detects LiteSpeed Web Server cPanel plugin endpoints that may be vulnerable to CVE-2026-48172 Redis enable/disable privesc to root. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteSpeed cPanel plugin privesc surface CVE-2026-48172.""" from kittysploit import from...

React2Shell CVE-2025-55182 Detection

Detects CVE-2025-55182 React2Shell by sending a safe React Flight multipart payload that evaluates 77+1 via the prefix gadget. Positive when the response reflects RSC deserialization behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect React2Shell CVE-2025-55182 on Next.js / React Serve...

Zammad CVE-2026-102489 Session Fixation Detect

Detects Zammad helpdesk instances potentially vulnerable to CVE-2026-102489 session fixation leading to RCE as the zammad user. Affects Zammad 6.3.0–6.5.4; chain with CVE-2026-102490 for root LPE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zammad session fixation RCE surface...

Cisco IOS SNMP CVE-2025-20352 Detection

Detects Cisco IOS/IOS-XE devices with SNMP exposed that may be vulnerable to CVE-2025-20352 stack-based buffer overflow in SNMP subsystem leading to unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco IOS/IOS-XE SNMP RCE surface CVE-2025-20352.""" from kittysploit impor...

ipTIME A2004 Info Disclosure (CVE-2024-54763)

Exploits CVE-2024-54763 in ipTIME A2004: unauthenticated /login/hostinfo.cgi discloses router model, firmware, and network configuration. !/usr/bin/env python3 -- coding: utf-8 -- """ipTIME A2004 hostinfo unauth disclosure CVE-2024-54763.""" import re from kittysploit import from...

Kyocera Printer LFI (CVE-2020-23575)

Exploits CVE-2020-23575 in Kyocera d-COPIA253MF: null-byte directory traversal via /wlmeng/ reads /etc/passwd and other local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer wlmeng traversal LFI CVE-2020-23575.""" import re from kittysploit import from...

NETGEAR Debug Auth Bypass (CVE-2020-27866)

Exploits CVE-2020-27866 on multiple NETGEAR routers: unauthenticated access to /setup.cgi?todo=debug exposes debug mode and configuration pages. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR password recovery auth bypass CVE-2020-27866.""" from kittysploit import from...

Telesquare TLR-2005KSH RCE (CVE-2024-29269)

Exploits CVE-2024-29269 in Telesquare TLR-2005KSH LTE routers: unauthenticated command injection via Cmd parameter in sysCommand. !/usr/bin/env python3 -- coding: utf-8 -- """Telesquare TLR-2005KSH command injection CVE-2024-29269.""" import re import urllib.parse from kittysploit import from...

TOTOLINK A3700R Command Injection (CVE-2023-46574)

Exploits CVE-2023-46574 in TOTOLINK A3700R: command injection in the FileName parameter of UploadFirmwareFile via /cgi-bin/cstecgi.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """TOTOLINK A3700R firmware upload command injection CVE-2023-46574.""" import json import re from kittysploit import...

TVT NVMS-1000 Path Traversal (CVE-2019-20085)

Exploits CVE-2019-20085 in TVT NVMS-1000: GET /..%2F traversal reads arbitrary files from the DVR/NVR host. !/usr/bin/env python3 -- coding: utf-8 -- """TVT NVMS-1000 path traversal LFI CVE-2019-20085.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zeroshell kerbynet RCE (CVE-2020-29390)

Exploits CVE-2020-29390 in Zeroshell 3.9.3: shell metacharacter injection via ampersand-wrapped commands in StartSessionSubmit User parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet ampersand injection CVE-2020-29390.""" import re import urllib.parse from kittysploit impo...

Zyxel NAS remote_help RCE (CVE-2024-29972)

Exploits CVE-2024-29972 in Zyxel NAS326/NAS542: unauthenticated command injection in remotehelp-cgi NsaRescueAngel backdoor path yields root command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS remotehelp-cgi command injection CVE-2024-29972.""" import re import urllib.parse...

Zyxel NBG2105 Auth Bypass (CVE-2021-3297)

Exploits CVE-2021-3297 in Zyxel NBG2105: Cookie login=1 grants administrator access to status and configuration pages without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NBG2105 cookie auth bypass CVE-2021-3297.""" from kittysploit import from lib.protocols.http.httpclient...

Apache Struts2 Content-Type OGNL RCE (CVE-2017-5638)

Exploits CVE-2017-5638 in Apache Struts 2.3.x/2.5.x via OGNL injection in the Content-Type header Jakarta multipart parser. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 Jakarta multipart OGNL RCE CVE-2017-5638.""" import re from kittysploit...

ChurchCRM API Authentication Bypass (CVE-2026-39339)

Exploits CVE-2026-39339 in ChurchCRM 7.1.0: URL injection with ?bypass=/api/public on protected API routes bypasses AuthMiddleware and returns sensitive person/family records without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM API auth bypass via URL injection...

Cisco Secure FMC Authentication Bypass (CVE-2026-20079)

Exploits CVE-2026-20079 in Cisco Secure Firewall Management Center: crafted CGISESSID=csmprocesses cookie bypasses authentication on CGI endpoints, exposing FMC system information and privileged management surfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Firewall FMC boot-time...

Citrix ADC/Gateway Template Injection RCE (CVE-2019-19781)

Exploits CVE-2019-19781 on Citrix ADC/Gateway: directory traversal writes a Perl-eval XML template under /netscaler/portal/templates/ then triggers it via newbm.pl for unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ADC/Gateway directory traversal template R...

Citrix NetScaler Pre-Auth Command Injection (CVE-2026-88771)

Exploits CVE-2026-88771 in Citrix NetScaler ADC/Gateway: attacker-controlled login values are logged and later interpolated into nsmonuploadderr.pl shell commands, yielding root command execution. Sends the pitboss/PPE log-poisoning payload via /nf/auth/doAuthentication.do watchTowr pattern...

F5 BIG-IP OAuth UserInfo Heap Overflow (CVE-2026-94127)

Exploits CVE-2026-94127 in F5 BIG-IP APM: crafted oversized Bearer tokens sent to the OAuth UserInfo endpoint trigger a heap buffer overflow when an APM access policy and OAuth Authorization Server profile are configured. !/usr/bin/env python3 -- coding: utf-8 -- """F5 BIG-IP APM OAuth UserInfo...

Flowise NVIDIA NIM Auth Bypass (CVE-2026-30824)

Exploits CVE-2026-30824 in Flowise 3.0.13: /api/v1/nvidia-nim/ routes are whitelisted in auth middleware, allowing unauthenticated token generation and container management API access. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise NVIDIA NIM auth bypass token leak CVE-2026-30824.""" import...

FortiOS SSL VPN Credential Leak (CVE-2018-13379)

Exploits CVE-2018-13379 path traversal in FortiOS/FortiProxy SSL VPN web portal to download /dev/cmdb/sslvpnwebsession and extract active session credentials. !/usr/bin/env python3 -- coding: utf-8 -- """FortiOS SSL VPN session credential leak CVE-2018-13379.""" import re from kittysploit import...

GitHub Enterprise Server Push Option RCE (CVE-2026-3854)

Exploits CVE-2026-3854 in GitHub Enterprise Server: crafted git push option values inject internal service headers during push operations, leading to remote code execution. Requires push access to a repository. !/usr/bin/env python3 -- coding: utf-8 -- """GitHub Enterprise Server push-option RCE...

Grafana Plugin Path Traversal LFI (CVE-2021-43798)

Exploits CVE-2021-43798 in Grafana 8.x: directory traversal via /public/plugins/NAME/ allows reading arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana plugin path traversal LFI CVE-2021-43798.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Ivanti CSA Auth Bypass (CVE-2024-8963)

Exploits CVE-2024-8963 in Ivanti Cloud Services Appliance 4.6 Patch 519: path traversal via index.php%3F.php/gsb/users.php exposes admin user management. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti CSA path traversal auth bypass CVE-2024-8963.""" from kittysploit import from...

Ivanti EPMM Authentication Bypass (CVE-2023-35078)

Exploits CVE-2023-35078 in Ivanti Endpoint Manager Mobile EPMM: unauthenticated access to /mifs/aad/api/v2/admins/users allows reading admin accounts and creating a new local administrator. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM unauthenticated admin API access CVE-2023-35078.""...

HPE iLO4 Authentication Bypass (CVE-2017-12542)

Exploits CVE-2017-12542 in HPE Integrated Lights-Out 4 before 2.53: unauthenticated REST access to /rest/v1/AccountService/Accounts and related APIs. !/usr/bin/env python3 -- coding: utf-8 -- """HPE iLO4 authentication bypass CVE-2017-12542.""" import json from kittysploit import from...

Ivanti Connect Secure Command Injection (CVE-2024-21887)

Chains CVE-2023-46805 path traversal auth bypass with CVE-2024-21887 command injection via /api/v1/totp/user-backup-code/../../admin/config/set on Ivanti Connect Secure / Policy Secure gateways. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure auth bypass + command injection...

Jenkins Stapler Groovy RCE (CVE-2018-1000861)

Exploits CVE-2018-1000861 in Jenkins =2.153 / LTS =2.138.3: ACL bypass on descriptorByName endpoints allows Groovy execution via checkScriptCompile. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins Stapler ACL bypass Groovy RCE CVE-2018-1000861.""" import re import urllib.parse from kittysplo...

Kemp LoadMaster Command Injection (CVE-2024-1212)

Exploits CVE-2024-1212 in Progress Kemp LoadMaster: unauthenticated command injection via /access/set?param=enableapi&value=... management API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster unauth command injection CVE-2024-1212.""" import re import urllib.parse from...

MOVEit Transfer SQL Injection RCE (CVE-2023-34362)

Exploits CVE-2023-34362 in Progress MOVEit Transfer: abuses moveitisapi.dll m2 header-smuggling to set guest session variables, then triggers UserGetUsersWithEmailAddress SQL injection via guestaccess.aspx to hijack an admin session or enable xpcmdshell for remote code execution. !/usr/bin/env...

Nette Framework Callback RCE (CVE-2020-15227)

Exploits CVE-2020-15227 in Nette Application before 2.0.19/3.0.6: attacker-controlled callback parameters passed to calluserfunc on /nette.micro/ yield remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Nette Framework callback injection RCE CVE-2020-15227.""" import re from...

Primefaces EL Injection RCE (CVE-2017-1000486)

Exploits CVE-2017-1000486 in Primefaces 5.x: weak AES passphrase allows forging pfdrid payloads that evaluate Java EL expressions for RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Primefaces weak encryption EL injection RCE CVE-2017-1000486.""" import base64 import re from hashlib import md5...

Progress LoadMaster Command Injection (CVE-2026-8037)

Exploits CVE-2026-8037 unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 JSON API via malformed g0-g15 fields WatchTowr pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Progress Kemp LoadMaster pre-auth command injection CVE-2026-8037.""" import json import re from...

phpVMS Legacy Importer Auth Bypass (CVE-2026-42569)

Exploits CVE-2026-42569 in phpVMS 7.0.6: unauthenticated access to the legacy /importer feature exposes database configuration and import controls. !/usr/bin/env python3 -- coding: utf-8 -- """phpVMS legacy importer auth bypass CVE-2026-42569.""" from kittysploit import from...

Pulse Secure SSL VPN File Read (CVE-2019-11510)

Exploits CVE-2019-11510 path traversal in Pulse Connect Secure to read arbitrary files such as /etc/passwd and VPN session data. !/usr/bin/env python3 -- coding: utf-8 -- """Pulse Secure SSL VPN arbitrary file read CVE-2019-11510.""" import re from kittysploit import from...

React2Shell RCE (CVE-2025-55182)

Exploits CVE-2025-55182 React2Shell via React Flight multipart deserialization. Targets Next.js App Router and React Server Components endpoints using the prefix / formData gadget chain. !/usr/bin/env python3 -- coding: utf-8 -- """React2Shell pre-auth RCE CVE-2025-55182 on Next.js / React Server...

SAP NetWeaver Metadata Uploader RCE (CVE-2025-31324)

Exploits CVE-2025-31324 unauthenticated file upload via SAP NetWeaver Visual Composer Metadata Uploader to deploy a JSP webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer Metadata Uploader RCE CVE-2025-31324.""" import re import...

Sophos Firewall Auth Bypass RCE (CVE-2022-1040)

Exploits CVE-2022-1040 in Sophos Firewall =18.5 MR3: authentication bypass in User Portal /userportal/Controller enables pre-auth Java deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall userportal auth bypass RCE CVE-2022-1040.""" import re from kittysploit import...

Spring Boot Actuator H2 RCE

Exploits exposed Spring Boot Actuator /actuator/env to inject an H2 connection-test-query CREATE ALIAS EXEC and restart the application, yielding remote command execution when spring.datasource.hikari is active. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Actuator H2...

UnRaid webGui PHP RCE (CVE-2020-5847)

Exploits CVE-2020-5847 in UnRaid str: php = f'?php echo shellexec"strcmd.replacechr34, chr...

vBulletin widget_php RCE (CVE-2019-16759)

Exploits CVE-2019-16759 in vBulletin 5.0.0–5.5.4 via unauthenticated ajax/render/widgettabbedcontainertabpanel widgetphp template injection. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin widgetphp RCE CVE-2019-16759.""" import hashlib import re import urllib.parse from kittysploit import...