Juniper J-Web PHPRC RCE (CVE-2023-36845)

Exploits CVE-2023-36845 in Juniper Junos J-Web: PHP environment variable modification via /?PHPRC=/dev/fd/0 enables autoprependfile code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Juniper J-Web PHPRC RCE CVE-2023-36845.""" import re from kittysploit import from...

Kibana Timelion RCE (CVE-2019-7609)

Exploits CVE-2019-7609 in Kibana 5.6.15 / 6.6.1: Timelion sheet prototype pollution yields Node.js childprocess execution. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Timelion prototype pollution RCE CVE-2019-7609.""" import json import re from kittysploit import from...

Kibana Console Path Traversal LFI (CVE-2018-17246)

Exploits CVE-2018-17246 in Kibana 6.4.3 / 5.6.13: path traversal in /api/console/apiserver apis parameter reads arbitrary local files. !/usr/bin/env python3 -- coding: utf-8 -- """Kibana Console plugin path traversal LFI CVE-2018-17246.""" import re from kittysploit import from...

Log4Shell RCE (CVE-2021-44228)

Exploits CVE-2021-44228 Log4j JNDI lookup injection via HTTP headers and query parameters. Uses sleep-based confirmation then delivers the configured reverse CMD payload through a user-supplied LDAP callback URL. !/usr/bin/env python3 -- coding: utf-8 -- """Log4Shell JNDI injection RCE...

Langflow Broken Access Control (CVE-2026-21445)

Exploits CVE-2026-21445 in Langflow 1.7.0.dev45: unauthenticated access to /api/v1/monitor/messages and related monitor endpoints exposes user conversation data and allows destructive operations without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """Langflow broken access control on...

mcp-server-kubernetes RCE (CVE-2026-61459)

Full-chain CVE-2026-61459: inject --server into kubectl MCP tools to exfiltrate the cluster bearer token, then create a privileged pod running the configured reverse CMD payload via the Kubernetes API. !/usr/bin/env python3 -- coding: utf-8 -- """mcp-server-kubernetes argument injection to pod RC...

NVIDIA Triton Inference Server Auth Bypass (CVE-2026-24207)

Exploits CVE-2026-24207 in NVIDIA Triton Inference Server = 26.02: unauthenticated access to restricted HTTP APIs including /models and model management endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """NVIDIA Triton Inference Server auth bypass CVE-2026-24207.""" import json from kittysplo...

N-able N-central Pre-Auth RCE (CVE-2026-86218)

Exploits CVE-2026-86218 in N-able N-central builds before 2026.3.1.14: pre-authentication static code injection via /remoteControlAction.do getPierDetails allows arbitrary Java code execution on the N-central server. !/usr/bin/env python3 -- coding: utf-8 -- """N-able N-central pre-auth static co...

Next.js RSC Multi-CVE Chain RCE

Full-chain Next.js RSC exploitation: tries CVE-2025-55182 React2Shell first, then falls back to Next.js-specific RSC endpoints. Integrates detection signals from CVE-2026-44582/44573/44578 auxiliary modules. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js RSC multi-CVE exploit chain...

Oracle EBS Unauth Upload RCE (CVE-2022-21587)

Exploits CVE-2022-21587 in Oracle EBS 12.2.3–12.2.11: unauthenticated file upload via BneOfflineLOVService uueupload extracts a JSP webshell under /forms/. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle E-Business Suite BneOfflineLOVService RCE CVE-2022-21587.""" import uuid from kittysploit...

Ruby on Rails YAML Deserialization RCE (CVE-2013-0156)

Exploits CVE-2013-0156 in Rails 3.x: XML requests with type=yaml deserialize attacker-controlled YAML into Ruby objects, reaching Kernelsystem via Gem gadgets. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails XML/YAML deserialization RCE CVE-2013-0156.""" from kittysploit import from...

SonicWall SMA1000 WorkPlace SSRF (CVE-2026-83548)

Exploits CVE-2026-83548 in SonicWall SMA1000 WorkPlace: unauthenticated absolute-form OPTIONS requests are forwarded to loopback CouchDB, enabling internal database access and downstream RCE chains. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall SMA1000 WorkPlace SSRF to CouchDB...

TeamCity Path Traversal Auth Bypass (CVE-2024-27199)

Exploits CVE-2024-27199 in JetBrains TeamCity: path traversal to /admin/diagnostic.jsp exposes debug logging and limited admin actions without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JetBrains TeamCity path traversal auth bypass CVE-2024-27199.""" from kittysploit import from...

ThinkPHP 5.0.23 RCE (CVE-2018-20062)

Exploits CVE-2018-20062 in ThinkPHP 5.0.23 via calluserfuncarray in index/think\app/invokefunction for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.0.23 invokefunction RCE CVE-2018-20062.""" import re from kittysploit import from lib.protocols.http.httpclient...

VMware vCenter vropsplugin RCE (CVE-2021-21972)

Exploits CVE-2021-21972 in VMware vCenter Server: unauthenticated arbitrary file upload via /ui/vropspluginui/rest/services/uploadova path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter vropsplugin upload RCE CVE-2021-21972.""" import re from kittysploit import from...

Yealink DM Command Injection RCE (CVE-2021-27561)

Exploits CVE-2021-27561 in Yealink Device Management 3.6.0.20: unauthenticated command injection via /sm/api/v1/firewall/zone/services zone parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink DM firewall zone command injection CVE-2021-27561.""" import re import urllib.parse from...

Zammad Session Fixation RCE (CVE-2026-102489)

Exploits CVE-2026-102489 in Zammad 6.3.0–6.5.4: session fixation allows hijacking an authenticated session and achieving remote code execution as the zammad service user via admin scheduler/trigger APIs. Chain with CVE-2026-102490 for root privilege escalation. !/usr/bin/env python3 -- coding:...

Citrix ShareFile File Read (CVE-2020-8982)

Exploits CVE-2020-8982 in Citrix ShareFile StorageZones str: depth = r'\..\' 8 target = re...

ManageEngine ServiceDesk RCE (CVE-2021-44077)

Exploits CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus: unauthenticated zip upload to /RestAPI/ImportTechnicians achieves path traversal and RCE. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus ImportTechnicians RCE CVE-2021-44077.""" import io import zipfile fro...

SharePoint Trust Endpoint Deserialization RCE (CVE-2026-50522)

Exploits CVE-2026-50522 in on-premises SharePoint: unauthenticated POST to /trust/default.aspx with a crafted wresult/wctx WS-Federation payload triggers unsafe BinaryFormatter deserialization for remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """SharePoint WS-Federation trust...

Windows Print Spooler RCE (PrintNightmare CVE-2021-34527)

Exploits CVE-2021-34527 PrintNightmare: abuses MS-RPRN RpcAddPrinterDriverEx to register a remote printer driver pointing at an attacker-controlled UNC DLL, executing code as SYSTEM when the Print Spooler service processes the install. !/usr/bin/env python3 -- coding: utf-8 -- """Windows Print...

nf_tables catch-all UAF LPE (CVE-2026-23111)

Local privilege escalation via CVE-2026-23111: nftables nftmapcatchallactivate abort-path use-after-free. Uploads and executes exploit binary on the target session to obtain root. !/usr/bin/env python3 -- coding: utf-8 -- """Linux LPE via nftables catch-all UAF CVE-2026-23111.""" import os import...

nf_tables Double-Free LPE (CVE-2024-1086)

Local privilege escalation via CVE-2024-1086: nftables nftverdictinit accepts NFDROP with positive errno, causing skb double-free in nfhookslow. Uploads and executes a compiled exploit on the target session requires unprivileged user namespaces and nftables on the victim. !/usr/bin/env python3 --...

OverlayFS FUSE LPE (CVE-2023-0386)

Local privilege escalation via CVE-2023-0386: FUSE + overlayfs copyup mishandles user xattrs on privileged files, allowing a low-privilege user to write SUID shell or /etc/passwd entries. Compiles and uploads the exploit to the target session requires libfuse-dev on operator host. !/usr/bin/env...

Cisco SD-WAN CVE-2026-76504 Detect

Detects CVE-2026-76504 on Cisco Catalyst SD-WAN Manager vManage: percent-encoded jsecuritycheck path bypasses authentication rules and returns an admin-level session cookie. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Cisco Catalyst SD-WAN Manager CVE-2026-76504 auth bypass surface.""" fr...

GitHub Enterprise Server CVE-2026-3854 Detection

Detects GitHub Enterprise Server instances potentially vulnerable to CVE-2026-3854 push option header injection leading to RCE. Checks GHES fingerprint and git push option endpoint behaviour. !/usr/bin/env python3 -- coding: utf-8 -- """Detect GitHub Enterprise Server push-option RCE surface...

noPac CVE-2021-42278/42287 Detect

Detects prerequisites for the noPac SamAccountName spoofing chain: authenticated LDAP access, ms-DS-MachineAccountQuota 0, and at least one domain controller computer object. Does not verify patch level. !/usr/bin/env python3 -- coding: utf-8 -- """Detect noPac CVE-2021-42278/42287 prerequisite...

Zerologon CVE-2020-1472 Detect

Detects CVE-2020-1472 Zerologon by attempting Netlogon NetrServerAuthenticate3 with all-zero credentials against the domain controller Netlogon RPC interface TCP/135 or 445. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zerologon Netlogon authentication bypass CVE-2020-1472.""" from...

Ivanti EPM CSA Code Injection (CVE-2021-44529)

Exploits CVE-2021-44529 in Ivanti EPM Cloud Services Appliance: crafted cookie values to /client/index.php execute arbitrary PHP code without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPM CSA unauthenticated code injection CVE-2021-44529.""" import base64 import re from...

VMware vCenter VSAN RCE (CVE-2021-21985)

Exploits CVE-2021-21985 in VMware vCenter: unauthenticated RCE via the VSAN Health Check plugin JSON API Virtual SAN Health Check. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter VSAN Health Check RCE CVE-2021-21985.""" import re from kittysploit import from...

WAVLINK Router Credential Leak (CVE-2022-31847)

Exploits CVE-2022-31847 in WAVLINK WN579: unauthenticated GET to /cgi-bin/ExportAllSettings.sh exposes admin Login/Password and Wi-Fi keys. !/usr/bin/env python3 -- coding: utf-8 -- """WAVLINK ExportAllSettings credential leak CVE-2022-31847.""" from kittysploit import from...

NETGEAR Router cgi-bin RCE (CVE-2016-6277)

Exploits CVE-2016-6277 in multiple NETGEAR routers: shell metacharacters in the cgi-bin path segment yield unauthenticated command execution. !/usr/bin/env python3 -- coding: utf-8 -- """NETGEAR router cgi-bin path command injection CVE-2016-6277.""" import re from kittysploit import from...

Citrix NetScaler CVE-2026-88772 Detect

Detects Citrix NetScaler ADC/Gateway builds likely affected by CVE-2026-88772 memory buffer restriction flaw enabling RCE/DoS. Confirms NetScaler presence and pre-CTX697096 firmware where exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Citrix NetScaler CVE-2026-88772 memory corruptio...

Scope Guard (PowerShell)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard PowerShell", "description": "Exit when the callback host i...

Kestra CVE-2026-49869 Auth Bypass Detect

Detects CVE-2026-49869 in Kestra OSS before 1.0.45 / 1.3.21: AuthenticationFilter forwards any /api/v1/ path ending in /configs without Basic Auth. Compares a blocked path with the bypass suffix, then optionally confirms with a benign echo flow create, execute, cleanup. !/usr/bin/env python3 --...

PaperCut CVE-2026-82078 SQL Primitive Detect

Detects CVE-2026-82078 in PaperCut NG/MF when chained with CVE-2026-81578: attacker-controlled user-lookup SQL templates and JDBC driver settings can be written via unauthenticated Tapestry ConfigEditor direct-service requests. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

PaperCut NG/MF Pre-Auth RCE (CVE-2026-81578 + CVE-2026-82078)

Chains CVE-2026-81578 Tapestry direct-service auth bypass with CVE-2026-82078 external user-lookup JDBC abuse. On PaperCut 26.x, reconfigures H2 INIT SQL to evaluate Groovy that launches a shell command, then restores factory lookup settings. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut...

Netcore NR289-GE CVE-2026-101072 Detect

Detects CVE-2026-101072 in Netcore NR289-GE: unauthenticated OS command injection via POST /x.ico/apip.cgi boa .ico auth bypass. The ip parameter is embedded into a wget shell command without validation. Uses a short echo probe when activeprobe is enabled. !/usr/bin/env python3 -- coding: utf-8 -...

ConnectWise ScreenConnect CVE-2026-84869 Detect

Detects ScreenConnect server deployments likely serving vulnerable client builds before 26.6.5.9742 CVE-2026-84869: guest file transfer without Host confirmation during active sessions. Parses version markers from Login/Host pages and flags releases below 26.6.5. !/usr/bin/env python3 -- coding:...

GitLab CVE-2026-85706 File Path LFI Detect

Detects CVE-2026-85706 in self-managed GitLab CE/EE before patched releases 17.11.7, 18.0.4, 18.1.2, 18.2.2, 18.3.2, 18.4.0: unauthenticated multipart uploads can supply file.path or metadata.path outside Workhorse temp dirs, leading to arbitrary file read. Sends a benign absolute-path probe only...

LiteLLM CVE-2026-59822 MCP Auth Bypass Detect

Detects CVE-2026-59822 in LiteLLM proxy before 1.84.0: failed LiteLLM key validation on the MCP Streamable HTTP endpoint falls back to an empty UserAPIKeyAuth object when a fabricated Authorization Bearer is supplied. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteLLM CVE-2026-59822 MCP...

Magento CVE-2026-71362 Customer Account Takeover

Exploits CVE-2026-71362 APSB26-92: a failed customer account editPost leaves attacker-controlled customerformdata in session, and a later edit consumes mass-assigned id to rebind the session to another customer. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CVE-2026-71362 customer session...

WSO2 JWT Auth Bypass Admin Enum (CVE-2026-5430)

Uses CVE-2026-5430 to reach WSO2 admin APIs with a forged alg:none JWT in X-JWT-Assertion. Lists applications and subscription keys when the gateway fails open on unsupported JWT algorithms. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 CVE-2026-5430 JWT alg:none admin API access via...

Netcore NR289-GE CVE-2026-101076 NTP CGI RCE

Exploits CVE-2026-101076 via POST /x.ico/setntpserverip.cgi on Netcore NR289-GE AC controllers. The ntpip parameter is embedded into a wget shell invocation without sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NR289-GE CVE-2026-101076 setntpserverip.cgi command injection."""...

Kestra <= 1.3.20 / 1.0.44 - /configs Auth Bypass RCE (CVE-2026-49869)

Exploits CVE-2026-49869: Micronaut AuthenticationFilter whitelists any path ending in /configs. Unauthenticated PUT creates a shell workflow, POST triggers execution, logs are polled for command output. Fixed in Kestra 1.0.45 and 1.3.21. !/usr/bin/env python3 -- coding: utf-8 -- """Kestra OSS...

Stage Verify (PowerShell)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify PowerShell", "description": "Verify staged artifact SHA256 before callback",...

Scope Guard (Python)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict, List from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard Python", "description": "Exit when the callback host is...

Signed Config (Python)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

Network Preflight (Zig)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Zig", "description": "Probe callback reachabilit...

Signed Config (Zig)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...