Fortinet FortiManager FGFM RCE Chain (CVE-2024-47575)

Exploits CVE-2024-47575 on FortiManager: unauthenticated FGFM TCP/541 registration and fileexchange acceptance. Confirms remoteid assignment, then uploads a putjsoncmd configuration blob for post-exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiManager FGFM unauth...

Cisco IOS SNMP RCE (CVE-2025-20352)

Exploits CVE-2025-20352 stack-based buffer overflow in Cisco IOS/IOS-XE SNMP subsystem. Sends crafted SNMP SET/GET packets to trigger overflow and execute shellcode or crash for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS/IOS-XE SNMP stack overflow RCE CVE-2025-20352."""...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

Exchange ProxyShell RCE (CVE-2021-34473)

Exploits the ProxyShell chain on Microsoft Exchange: SSRF via Autodiscover CVE-2021-34473, elevation to SYSTEM mailbox CVE-2021-34523, and arbitrary file write CVE-2021-31207 to drop an ASPX webshell and execute a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchang...

SolarWinds WHD Deserialization RCE (CVE-2024-28986)

Exploits CVE-2024-28986 in SolarWinds Web Help Desk 12.8.3: Java deserialization on Helpdesk.woa endpoints allows remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Web Help Desk deserialization RCE CVE-2024-28986.""" import re from kittysploit import from...

bad_epoll UAF LPE (CVE-2026-46242)

Local privilege escalation via CVE-2026-46242 epoll use-after-free. Compiles and uploads exploit to target session for root shell. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via epoll UAF CVE-2026-46242.""" import os import shlex import tempfile from kittysploit import from...

ptrace Credential Steal LPE (CVE-2026-4633)

Local privilege escalation via CVE-2026-4633: ptracemayaccess / pidfdget credential-steal primitive. Compiles and uploads exploit to the target session to obtain root. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via ptrace credential steal CVE-2026-4633.""" import os import shlex impor...

SharePoint ToolShell CVE-2025-53770 Detection

Detects on-premises Microsoft SharePoint ToolShell exposure: unauthenticated access to ToolPane.aspx via Referer bypass CVE-2025-53771 and unsafe deserialization surface CVE-2025-53770. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SharePoint ToolShell auth bypass CVE-2025-53771 and ToolPan...

Citrix Bleed Session Token Steal (CVE-2023-4966)

Auxiliary module for CVE-2023-4966 Citrix Bleed: sends an oversized Host header to NetScaler OAuth endpoints to trigger an out-of-bounds memory read and capture leaked session cookies/tokens from the response body. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix Bleed session token leak...

Aquatronica Controller Credential Leak (CVE-2025-25037)

Exploits CVE-2025-25037 in Aquatronica Controller =5.1.6: unauthenticated POST to tcp.php WSGETNETWORKCFG exposes plaintext WEBPASSWORD. !/usr/bin/env python3 -- coding: utf-8 -- """Aquatronica tcp.php credential leak CVE-2025-25037.""" from kittysploit import from lib.protocols.http.httpclient...

ASUS GT-AC2900 Auth Bypass (CVE-2021-32030)

Exploits CVE-2021-32030 in ASUS GT-AC2900: asustoken null-byte cookie with asusrouter User-Agent grants unauthenticated admin API access. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS GT-AC2900 null-byte auth bypass CVE-2021-32030.""" import json from kittysploit import from...

PetitPotam NTLM Coercion

Coerces a Windows target to authenticate to an attacker-controlled listener via the EfsRpcOpenFileRaw API PetitPotam / CVE-2021-36942. Use with an SMB or HTTP relay listener to capture NTLM hashes or relay. !/usr/bin/env python3 -- coding: utf-8 -- """PetitPotam NTLM coercion via EfsRpcOpenFileRa...

Brother MFC Info Disclosure (CVE-2024-51977)

Exploits CVE-2024-51977 in Brother MFC-L9570CDW: unauthenticated GET to /etc/mntinfo.csv leaks model, firmware, IP, and serial number. !/usr/bin/env python3 -- coding: utf-8 -- """Brother MFC mntinfo disclosure CVE-2024-51977.""" from kittysploit import from lib.protocols.http.httpclient import...

Buffalo WSR Auth Bypass (CVE-2021-20090)

Exploits CVE-2021-20090 in Buffalo WSR-2533 and Arcadyan-based routers: /images/..%2f traversal bypasses authentication and exposes admin info.html. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo/Arcadyan path traversal auth bypass CVE-2021-20090.""" from kittysploit import from...

Cisco RV132W Config Disclosure (CVE-2018-0127)

Exploits CVE-2018-0127 in Cisco RV132W/RV134W: unauthenticated /dumpmdm.cmd discloses device configuration including sensitive parameters. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco RV132W/RV134W MDM config leak CVE-2018-0127.""" from kittysploit import from lib.protocols.http.httpclient...

Cyberoam NetGenie XSS (CVE-2021-38702)

Exploits CVE-2021-38702 in Cyberoam NetGenie: reflected XSS via the u parameter of /tweb/ft.php on router admin interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberoam NetGenie reflected XSS CVE-2021-38702.""" import urllib.parse from kittysploit import from lib.protocols.http.httpclien...

Dahua RPC Login Auth Bypass (CVE-2021-33044)

Exploits CVE-2021-33044 and CVE-2021-33045 in Dahua IPC/VTH/VTO: crafted global.login RPC requests bypass authentication and return a valid session. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua RPC login auth bypass CVE-2021-33044 / CVE-2021-33045.""" import json from kittysploit import fro...

D-Link DAR-8000 Command Injection (CVE-2023-4542)

Exploits CVE-2023-4542 in D-Link DAR-8000-10: OS command injection via the id parameter of /app/sys1.php. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAR-8000 sys1.php command injection CVE-2023-4542.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

D-Link DIR850 Open Redirect (CVE-2021-46379)

Exploits CVE-2021-46379 in D-Link DIR850: unauthenticated open redirect via formWlanRedirect redirect-url parameter phishing / token theft chain. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR850 open redirect CVE-2021-46379.""" import re import urllib.parse from kittysploit import from...

D-Link DIR-600M Auth Bypass (CVE-2019-13101)

Exploits CVE-2019-13101 in D-Link DIR-600M: unauthenticated access to WAN configuration pages such as /wan.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-600M auth bypass CVE-2019-13101.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link DNS-320 login_mgr RCE (CVE-2019-16057)

Exploits CVE-2019-16057 in D-Link DNS-320 str: inj = urllib.parse.quotef'80|cmd', safe='' p...

D-Link Router Sip Parameter RCE (CVE-2018-10823)

Exploits CVE-2018-10823 in D-Link DWR routers: command injection via the Sip parameter on chkisg.htm. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link router chkisg.htm command injection CVE-2018-10823.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

FortiWeb Reflected XSS (CVE-2021-22122)

Exploits CVE-2021-22122 in FortiWeb 6.2/6.3: unauthenticated reflected XSS via error3 and omnisuccess API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """FortiWeb reflected XSS CVE-2021-22122.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Fortinet FortiWeb Fabric Connector SQLi (CVE-2025-25257)

Exploits CVE-2025-25257 pre-auth SQL injection in FortiWeb Fabric Connector /api/fabric/device/status via a crafted Authorization Bearer token, then attempts OS command execution through stacked SQL payloads WatchTowr chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiWeb Fabric...

Güralp MAN-EAM XXE LFI (CVE-2022-38840)

Exploits CVE-2022-38840 in Güralp MAN-EAM-0003 3.2.4: XXE via xmldata in POST /cgi-bin/xmlstatus.cgi reads local files such as /etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Güralp MAN-EAM-0003 xmlstatus XXE LFI CVE-2022-38840.""" import re from kittysploit import from...

GL.iNET Wi-Fi Key Disclosure (CVE-2023-31478)

Exploits CVE-2023-31478 in GL.iNet routers 3.216: unauthenticated POST to /api/router/mesh/status leaks SSID and Wi-Fi encryption key. !/usr/bin/env python3 -- coding: utf-8 -- """GL.iNET mesh status Wi-Fi key disclosure CVE-2023-31478.""" from kittysploit import from lib.protocols.http.httpclien...

Intelbras Switch Config Leak (CVE-2023-36144)

Exploits CVE-2023-36144 in Intelbras SG 2404 MR: unauthenticated GET to /cgi-bin/exportCfgwithpasswd downloads full device backup with credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Intelbras Switch config export leak CVE-2023-36144.""" from kittysploit import from...

LiteSpeed cPanel Plugin Privesc RCE (CVE-2026-48172)

Exploits CVE-2026-48172 in the LiteSpeed cPanel plugin: mishandled Redis enable/disable API allows privilege escalation and arbitrary command execution as root via crafted cpaneljsonapi requests. !/usr/bin/env python3 -- coding: utf-8 -- """LiteSpeed cPanel plugin privesc to RCE CVE-2026-48172.""...

Node-RED Unauthenticated Flow RCE

Deploys a malicious Node-RED flow via the admin API when authentication is disabled or credentials are known. Uses an inject + exec node chain to run the configured reverse CMD payload. Complements CVE-2026-71269 detection. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RED unauthenticated flo...

QNAP Photo Station File Read (CVE-2019-7192)

Exploits CVE-2019-7192 in QNAP Photo Station: album/slideshow workflow plus filename traversal in /p/api/video.php reads arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP Photo Station path traversal file read CVE-2019-7192.""" import re from kittysploit import from...

NUUO NVRmini Command Injection (CVE-2018-14933)

Exploits CVE-2018-14933 in NUUO NVRmini via command injection in the uploaddir parameter of upgradehandle.php. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini upgradehandle.php RCE CVE-2018-14933.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclien...

Tenda AC1200 Auth Bypass (CVE-2022-40843)

Exploits CVE-2022-40843 in Tenda AC1200 V-W15Ev2: empty W15Ev2user cookie bypasses authentication and exposes syslog/config containing admin password hash. !/usr/bin/env python3 -- coding: utf-8 -- """Tenda AC1200 session auth bypass CVE-2022-40843.""" import re from kittysploit import from...

TerraMaster TOS Info Disclosure (CVE-2022-24990)

Exploits CVE-2022-24990 in TerraMaster TOS 4.2.30: User-Agent TNAS on webNasIPS leaks firmware, network config, and admin password hash PWD. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster TOS webNasIPS info disclosure CVE-2022-24990.""" import re from kittysploit import from...

TP-Link Router LFI (CVE-2015-3035)

Exploits CVE-2015-3035 in TP-Link Archer/TL-WR routers: path traversal via /login/../../../ reads arbitrary local files including password stores. !/usr/bin/env python3 -- coding: utf-8 -- """TP-Link Archer local file inclusion CVE-2015-3035.""" import re from kittysploit import from...

Visual Tools DVR Shellshock RCE (CVE-2021-42071)

Exploits CVE-2021-42071 in Visual Tools DVR VX16: Shellshock in User-Agent on /cgi-bin/slogin/login.py yields unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Tools DVR Shellshock RCE CVE-2021-42071.""" import re from kittysploit import from...

Xiaomi Mi WiFi R3G LFI (CVE-2019-18371)

Exploits CVE-2019-18371 in Xiaomi Mi WiFi R3G 2.28.23: NGINX alias misconfiguration allows reading /etc/config/account and other files via api-third-party/download. !/usr/bin/env python3 -- coding: utf-8 -- """Xiaomi Mi WiFi R3G NGINX alias LFI CVE-2019-18371.""" import re from kittysploit import...

WyreStorm Apollo VX20 Config Leak (CVE-2024-25735)

Exploits CVE-2024-25735 in WyreStorm Apollo VX20 1.3.58: unauthenticated GET /device/config exposes SoftAP router credentials in JSON. !/usr/bin/env python3 -- coding: utf-8 -- """WyreStorm Apollo VX20 config leak CVE-2024-25735.""" from kittysploit import from lib.protocols.http.httpclient impor...

Yachtcontrol systemcall RCE (CVE-2019-17270)

Exploits CVE-2019-17270 in Yachtcontrol webapplication 1.0: unauthenticated OS command injection via /pages/systemcall.php?command=. !/usr/bin/env python3 -- coding: utf-8 -- """Yachtcontrol systemcall.php command injection CVE-2019-17270.""" import re import urllib.parse from kittysploit import...

Zyxel Firewall Auth Bypass (CVE-2022-0342)

Exploits CVE-2022-0342 in Zyxel USG/ZyWALL/ATP/VPN/NSG: unauthenticated export-cgi downloads startup-config.conf with admin credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel firewall export-cgi auth bypass CVE-2022-0342.""" from kittysploit import from lib.protocols.http.httpclient...

Zeroshell kerbynet RCE (CVE-2019-12725)

Exploits CVE-2019-12725 in Zeroshell 3.9.0: newline injection in the User parameter of kerbynet StartSessionSubmit yields unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Zeroshell kerbynet command injection CVE-2019-12725.""" import re import urllib.parse from kittysploit import...

Zyxel GS1900 CGI Stack Overflow RCE (CVE-2026-7273)

Exploits CVE-2026-7273 pre-authentication stack-based buffer overflow in Zyxel GS1900 smart-managed switch CGI handlers. Sends an oversized HTTP POST to /cgi-bin/dispatcher.cgi and alternate CGI endpoints to trigger memory corruption and attempt command execution. Firmware = 2.90XXXX.1C0 is...

Zyxel NAS zylog RCE (CVE-2023-27992)

Exploits CVE-2023-27992 in Zyxel NAS: pre-auth command injection via configuremailsyslog after auth-bypass path /cmd,/ck6fup6/zylogmain/. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NAS zylog pre-auth command injection CVE-2023-27992.""" import re import urllib.parse from kittysploit impor...

Citrix NetScaler SAML RCE Chain (CVE-2023-3519)

Targets CVE-2023-3519 on Citrix ADC/Gateway SAML IdP/Gateway configurations. Confirms /saml/login processing, then attempts CVE-2019-19781 template injection as a fallback when directory traversal is available on the same appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler SA...

Adobe ColdFusion RDS Auth Bypass (CVE-2013-0632)

Exploits CVE-2013-0632 in Adobe ColdFusion: empty adminpassword with rdsPasswordAllowed=1 on administrator.cfc?method=login yields CF admin session. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion RDS auth bypass CVE-2013-0632.""" import re from kittysploit import from...

ConnectWise ScreenConnect Guest Transfer (CVE-2026-84869)

Targets CVE-2026-84869 in ScreenConnect before 26.6.5.9742: guest file transfer without Host confirmation during active sessions. Validates vulnerable build markers and probes guest-accessible transfer endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect guest file...

Drupal Drupalgeddon2 RCE (CVE-2018-7600)

Exploits CVE-2018-7600 in Drupal 7/8 via form API render array injection on /user/register mailpostrender=passthru for unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal Drupalgeddon2 RCE CVE-2018-7600.""" import re from kittysploit import from lib.protocols.http.httpclient...

ForgeRock OpenAM Deserialization RCE (CVE-2021-35464)

Exploits CVE-2021-35464 in ForgeRock OpenAM 7.0: pre-auth Java deserialization via jato.pageSession on /openam/oauth2/..;/ccversion/ path traversal routes. !/usr/bin/env python3 -- coding: utf-8 -- """ForgeRock OpenAM Jato deserialization RCE CVE-2021-35464.""" import re from kittysploit import...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

Ivanti EPMM Authentication Bypass (CVE-2023-35082)

Exploits CVE-2023-35082 in Ivanti EPMM MobileIron Core 11.2 and older: unauthenticated access to /mifs/asfV3/api/v2/admins/users allows admin enumeration and account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPMM/MobileIron unauthenticated API access CVE-2023-35082.""" import...

Ivanti Endpoint Manager Auth Bypass (CVE-2026-1603)

Exploits CVE-2026-1603 in Ivanti Endpoint Manager 2024 SU5: unauthenticated POST to /RemoteControlAuth/api/Auth with logintype 64 leaks session identifiers and stored credential metadata. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint Manager auth bypass CVE-2026-1603.""" import jso...