DjangoCRM CVE-2026-71238 Debug Disclosure Detect

Detects CVE-2026-71238 in DjangoCRM 0.91 through 2.4.0: shipped webcrm/settings.py keeps DEBUG=True and relies on secret URL prefixes for admin/CRM access. A bogus i18n 404 triggers Django's technical404response and leaks those prefixes to any anonymous requester, defeating access-by-obscurity...

Snipe-IT CVE-2026-37709 File Upload Detect

Detects CVE-2026-37709 in Snipe-IT ≤ 8.4.0 fixed in 8.4.1: POST /api/v1/objecttype/id/files checks the view permission instead of update, so any API user with view-only access can upload files to visible objects. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Snipe-IT CVE-2026-37709 view-onl...

DjangoCRM Debug Info Disclosure (CVE-2026-71238)

CVE-2026-71238 in DjangoCRM 0.91 through 2.4.0: shipped webcrm/settings.py keeps DEBUG=True and uses secret URL prefixes as the only access gate. An unauthenticated bogus i18n 404 dumps the live URLconf, and /voip/get-callback/ returns a full technical500 debug page with source paths and framewor...

WordPress Core CVE-2026-64638 XSS2Shell Detect

Detects CVE-2026-64638 in WordPress Core 4.7.0 through 7.0.2: pre-auth reflected XSS via striptags/KSES parser differential on /wp-login.php. Fixed in 7.0.3 and backports. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WordPress Core CVE-2026-64638 XSS2Shell parser differential.""" from...

Node-RED CVE-2026-71269 Library DoS Detect

Detects Node-RED 3.0.0–5.0.4 admin library API exposure for CVE-2026-71269: GET /library/local/flows on the httpAdminRoot surface. A reachable library endpoint indicates the target may be affected by the unauthenticated DoS via POST /library/local//%2e%2e discarded write promise crash on Node.js ...

Trilium Notes CVE-2026-45668 Safe Import RCE Detect

Detects CVE-2026-45668 in Trilium Notes TriliumNext desktop = 0.102.1: safe import fails to strip docName path traversal and code-note XSS, enabling RCE in the nodeIntegration Electron renderer. Fingerprints /bootstrap for triliumVersion fixed in 0.102.2. !/usr/bin/env python3 -- coding: utf-8 --...

OpenCTI Auth Bypass (CVE-2026-27960)

CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The compile-time admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f authenticates as admin on every deployment. !/usr/bin/env python3 -- coding:...

osTicket Reset Token Auth Bypass (CVE-2026-18363)

CVE-2026-18363 in osTicket 1.17.8 and 1.18.0–1.18.3: password reset tokens are accepted forever because the expiry gate in PasswordResetTokenBackend::signOn never runs for existing tokens. POST the victim's reset token to /scp/pwreset.php to obtain an authenticated agent session; optionally set a...

Node-RED Library DoS (CVE-2026-71269)

CVE-2026-71269 in Node-RED 3.0.0–5.0.4 on Node.js = 15: POST /library/local//%2e%2e makes saveLibraryEntry write to the library directory itself; the discarded util.writeFile EISDIR rejection becomes an uncaught exception and Node-RED exits. The HTTP layer answers 204 before the crash. DESTRUCTIV...

SiYuan MCP Auth Bypass (CVE-2026-66012)

CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2 fixed 3.7.2: POST /mcp on the Publish port checks auth presence only and accepts RoleReader. With anonymous Publish mode Conf.Publish.Enable=true, Conf.Publish.Auth.Enable=false all MCP tools including file read/write reach the workspace without...

DbGate Script Runner RCE (CVE-2026-47668)

Exploits CVE-2026-47668 in DbGate ;// runs arbitrary Node.js as root. Anonymous POST /auth/login often yields a JWT. Delivers the configured framework payload reversetcp by default; set payload nopayload to capture verifycmd output via out.txt under /runners/data//. !/usr/bin/env python3 -- codin...

Flowise CVE-2026-69251 TypeORM RCE Detect

Detects CVE-2026-69251 in Flowise = 3.1.2 fixed 3.1.3: SQLiteRecordManager spreads user-supplied additionalConfig into TypeORM DataSource options; entities globs cause require of attacker-uploaded .js during initialize. Chains register, login, document store, File Loader upload, and...

OpenCTI CVE-2026-27960 Auth Bypass Detect

Detects CVE-2026-27960 in OpenCTI 6.6.0 through 6.9.12: authenticateUserByTokenOrUserId looks up users by bearer token without verifying it equals apitoken. The admin internalid 88ec0c6a-13ce-5e39-b486-354fe4a7084f is identical across deployments and authenticates as admin when sent as a bearer...

osTicket CVE-2026-18363 Reset Token Detect

Detects CVE-2026-18363 in osTicket 1.17.8 and 1.18.0–1.18.3: PasswordResetTokenBackend accepts reset tokens forever because the expiry check never runs for existing tokens. Requires a victim reset token out-of-band. !/usr/bin/env python3 -- coding: utf-8 -- """Detect osTicket CVE-2026-18363 expir...

SiYuan CVE-2026-66012 MCP Auth Bypass Detect

Detects CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2: POST /mcp on the Publish port default 6808 accepts anonymous RoleReader JWTs when Publish auth is disabled, exposing MCP tools including workspace file read without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SiYuan...

Flowise TypeORM RCE (CVE-2026-69251)

Exploits CVE-2026-69251 in Flowise = 3.1.2 fixed 3.1.3: record-manager nodes spread additionalConfig JSON into TypeORM DataSource; entities globs trigger require of attacker-uploaded JavaScript during initialize. Chains first-account register, cookie login, File Loader upload, and...

LiteLLM Pre-Auth Blind SQLi (CVE-2026-42208)

CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: the proxy virtual-key lookup builds SQL with WHERE v.token = 'token' and interpolates the raw bearer from failed auth logging. Inject via Authorization on LLM routes must NOT start with sk-. Calibrates timing, confirms pgsleep scales, th...

Trilium Notes Safe Import RCE (CVE-2026-45668)

Exploits CVE-2026-45668 in Trilium Notes TriliumNext = 0.102.1: a malicious export ZIP imported with safeImport=true keeps a code-note XSS payload, a docName label with path traversal, and a '' noteId preserved verbatim. Opening the trigger doc loads the payload via jQuery into a nodeIntegration...

Ollama GGUF Heap OOB Read (CVE-2026-7482)

CVE-2026-7482 in ollama/ollama then triggers model creation. Success leaks heap memory into the stored Q80 layer. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-7482 — Ollama GGUF heap out-of-bounds read info disclosure.""" import hashlib import json import struct import requests from...

Gogs PutContents Symlink RCE (CVE-2025-8110)

Exploits CVE-2025-8110 in Gogs .git/config and a PutContents write poisons core.sshCommand for RCE on the following git push. Delivers the configured framework payload reversetcp session by default. Requires an account that can create a repository and the git client binary on the attacker host...

Prometheus Azure AD Secret Disclosure (CVE-2026-42151)

CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was typed as a plain Go string instead of configutil.Secret. When Prometheus serializes its running config via /api/v1/status/config or /-/config, the real Azure AD clientsecret is emitted in plaintext instead of...

Prometheus CVE-2026-42151 Secret Disclosure Detect

Detects CVE-2026-42151 in Prometheus 2.48.0–3.5.2 and 3.6.0–3.11.2: OAuthConfig.ClientSecret was a plain Go string instead of configutil.Secret, so /api/v1/status/config and /-/config emit the real Azure AD clientsecret instead of redacting it as ''. !/usr/bin/env python3 -- coding: utf-8 --...

kotaemon Insecure Deserialization RCE (CVE-2026-69098)

Exploits CVE-2026-69098 in kotaemon str: """Mock-wrapped subprocess.checkoutput spec for deserializesafe=False.""" cmd = strcommand or "".strip spec = "type": "unittest.mock.Mock", "returnvalue": "type": "subprocess.checkoutput", "args": "sh", "-c", f"cmd 2&1; true", "text": True, , return...

Marimo Terminal WebSocket Pre-Auth RCE (CVE-2026-39987)

Exploits CVE-2026-39987 in Marimo = 0.20.4 patched in 0.23.0: the /terminal/ws endpoint accepts unauthenticated WebSocket connections and spawns a PTY shell pty.fork with no validateauth check. Opens an interactive httpcmd session by default; optional COMMAND for one-shot execution or framework...

WordPress Instant Appointment CVE-2026-15282 Detect

Detects Instant Appointment = 1.2 vulnerable to CVE-2026-15282: unauthenticated addservicefront AJAX writes arbitrary files via filegetcontentsimageurl + fileputcontentsimagename. Fixed in .... !/usr/bin/env python3 -- coding: utf-8 -- """Detect Instant Appointment CVE-2026-15282 = 1.2...

JTL Shop Smarty SSTI RCE (CVE-2026-54390)

Exploits CVE-2026-54390 in JTL Shop 5.4.0–5.7.1: unauthenticated contact form input reaches SmartyRenderer::fetch'string:' . $subject. Serves the configured framework PHP payload locally, injects a Smarty system write primitive via vorname, waits for async email rendering, then triggers reversetc...

MSSQL TGT Delegation via SQL CLR

Extracts a forwarded Kerberos TGT through MSSQL by loading a CLR assembly into sqlservr.exe and invoking SSPI tgtdeleg against a target SPN. Avoids spawning cmd.exe or powershell.exe; restores CLR settings after execution. !/usr/bin/env python3 -- coding: utf-8 -- """Remote TGT extraction via MSS...

WordPress WP Maps Blind SQLi (CVE-2026-39492)

Exploits CVE-2026-39492 in WP Maps bool: , sigma, threshold, samplecount = self.module.wpmapsbaselineself.module.wpbase if samplecount 3.0: return False self.threshold = threshold return True def probeself, condition: str - float: self.requests += 1 payload = self.module.wpmapsifpayloadcondition,...

JTL Shop CVE-2026-54390 Smarty SSTI Detect

Detects JTL Shop 5.2.0 through 5.7.1 vulnerable to CVE-2026-54390: contact form fields reach SmartyRenderer email subjects via fetch'string:' . $subject. Versions 5.4.0+ allow full RCE via registered Smarty modifiers; 5.2.x–5.3.x allow credential theft. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Instant Appointment RCE (CVE-2026-15282)

Exploits CVE-2026-15282 in Instant Appointment = 1.2: unauthenticated addservicefront AJAX passes imageurl/imagename to filegetcontents and fileputcontents. Delivers the configured framework PHP payload via data:// base64 primary or a local HTTP server fallback, writes under wp-content/uploads/,...

WordPress WP Maps CVE-2026-39492 Detect

Detects WP Maps wp-google-map-plugin = 4.9.1 vulnerable to CVE-2026-39492: unauthenticated time-based blind SQLi in wpgmpajaxcall via backtick-wrapped locationid bypassing escsql. Fixed in 4.9.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WP Maps CVE-2026-39492 blind SQLi = 4.9.1.""" fro...

Gitea/Forgejo CVE-2026-60004 Diffpatch Detect

Detects Gitea or Forgejo instances potentially affected by CVE-2026-60004 unauthenticated/authenticated diffpatch git hook RCE via bare-clone add/add conflict on hooks/post-index-change. Fixed in Gitea 1.27.1. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea/Forgejo CVE-2026-60004...

WordPress Podlove Podcast Publisher CVE-2026-13001 Detect

Detects Podlove Podcast Publisher = 4.5.1 vulnerable to unauthenticated file upload via image cache extension bypass CVE-2026-13001. Fixed in 4.5.2. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Podlove Podcast Publisher CVE-2026-13001 = 4.5.1.""" from kittysploit import from...

WordPress Podlove Podcast Publisher RCE (CVE-2026-13001)

Exploits CVE-2026-13001 in Podlove Podcast Publisher = 4.5.1: serves a GIF89a polyglot built from the configured framework payload, triggers the image-cache fetch shell.php?.gif bypass, then executes the cached PHP via HTTP reversetcp connects back through the normal listener. !/usr/bin/env pytho...

Gitea/Forgejo Diffpatch Hook RCE (CVE-2026-60004)

Exploits CVE-2026-60004 in Gitea/Forgejo 1.27.1: register or use supplied credentials, create a repository, submit the same malicious diffpatch twice to trigger an add/add conflict that writes hooks/post-index-change, then execute a command via the auto-fired git hook. !/usr/bin/env python3 --...

ProFTPD mod_sql STOR basename RCE (CVE-2026-42167)

CVE-2026-42167 post-auth variant: an authenticated FTP user uploads a file whose basename starts/ends with a single quote isescapedtext bypass and embeds stacked SQL. With SQLLog STOR logging %basename into PostgreSQL, COPY TO PROGRAM runs an OS command on the DB host. Filenames cannot contain '/...

ProFTPD mod_sql is_escaped_text() pre-auth RCE (CVE-2026-42167)

CVE-2026-42167: ProFTPD modsql skips escaping when isescapedtext decides a value is already quoted. A crafted FTP USER value that starts and ends with a single quote and contains none in between injects stacked SQL into SQLLog / SQLNamedQuery templates. With a PostgreSQL backend whose role can CO...

Joomla Aimy Captcha-Less Form Guard RCE (CVE-2026-65883)

Unauthenticated RCE in Aimy Captcha-Less Form Guard 18.0–20.0: recover the XOR keystream from the clfgd field, inject a FormattedtextLogger gadget, write a PHP webshell, then execute the configured payload. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-65883 — Aimy Captcha-Less Form Guard...

Joomla Aimy Captcha-Less Form Guard CVE-2026-65883 Detect

Detects the Aimy Captcha-Less Form Guard plugin clfgd field on Joomla forms. Versions 18.0–20.0 are affected by CVE-2026-65883 unauthenticated PHP object injection via XOR'd clfgd → unserialize. Patched in 20.1. Detection only — no gadget upload. !/usr/bin/env python3 -- coding: utf-8 -- """Detec...

MediaWiki CVE-2026-58025 Detect

Fingerprints MediaWiki and flags versions affected by CVE-2026-58025: LogEntryBase::extractParams called unserialize on user-controlled logparams from WikiImporter XML . Affected: Optionalbool: """Affected: 1 else 0 patch = parts2 if lenparts 2 else 0 if minor = 46: return False if minor == 45:...

Offline VM Credential Extract

Upload and run an offline VM credential extractor on a Linux session hypervisor/NAS against memory snapshots or virtual disks — NTLM, WDigest, Kerberos, SAM/LSA/DCC2, NTDS, DPAPI, BitLocker FVEK — without exfiltrating full disk images. Compatible with VMkatz-style CLIs. !/usr/bin/env python3 --...

MediaWiki CVE-2026-58025 Import Deserialization

Authenticated exploit for CVE-2026-58025: upload a MediaWiki XML export with PHP-serialized via Special:Import. On vulnerable hosts, LogEntryBase::extractParams unserializes without allowedclasses. Use scanner/http/mediawikicve202658025detect for version checks. Requires import/importupload. No...

Livewire PowerGrid CVE-2026-65971 Detect

Detects CVE-2026-65971: time-based SQL injection via sortDirection in power-components/livewire-powergrid 6.10.4 when a column uses naturalSorttrue. Empty sortField bypasses Laravel direction validation. !/usr/bin/env python3 -- coding: utf-8 -- """Detect CVE-2026-65971 Livewire PowerGrid...

Livewire PowerGrid CVE-2026-65971 sortDirection SQLi

Confirms/exploits CVE-2026-65971: SQL injection in power-components/livewire-powergrid = 6.0.0, 0 else self.delay 0.6 self.baseline = 0.0 self.requests = 0 def calibrateself - bool: self.baseline, = self.module.update"", "asc" self.requests += 1 return self.true"1=1" and not self.true"1=2" def...

MySQL TLS Capability

Reports whether the MySQL/MariaDB handshake advertises SSL/TLS CLIENTSSL. Flags servers that do not support TLS. !/usr/bin/env python3 -- coding: utf-8 -- """Report MySQL/MariaDB TLS capability from the server handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

mDNS / DNS-SD Enum

Enumerates DNS-SD instances via unicast or multicast mDNS, resolves PTR→SRV/TXT/A, and suggests KittySploit protocol sessions. !/usr/bin/env python3 -- coding: utf-8 -- """Deep mDNS / DNS-SD enumeration with SRV/TXT/A correlation and module handoff.""" from kittysploit import from...

SSH login bruteforce

Attempts common and wordlist-based SSH password credentials. Prefer running after scanner/ssh/sshauthmethods when password or keyboard-interactive auth is offered. Registers an SSH session on success. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """ SSH login bruteforce —...

CoAP Config Dump

Enumerate .well-known/core and GET common IoT config/status paths device, version, firmware, sensor, … to dump readable state. !/usr/bin/env python3 -- coding: utf-8 -- """Dump CoAP device/config resources well-known + common IoT paths.""" from kittysploit import from lib.protocols.coap.client...

PostgreSQL Empty Password

Tests common PostgreSQL usernames for trust or empty-password login via psycopg2. Authorized targets only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PostgreSQL trust / empty-password access.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

BLE UART exec

Send a command string over a BLE UART/NUS write characteristic and collect the notify response serial-over-GATT pivot. !/usr/bin/env python3 -- coding: utf-8 -- """Execute a command over BLE UART/NUS pivot channel.""" from kittysploit import from lib.protocols.ble.blesessionmixin import...