StreamSets Transformer auth none ScalaDTransform RCE

Unauthenticated /rest/v1 pipeline API: ScalaDTransform stage runs sh -c with attacker command http.authentication=none. """StreamSets Transformer auth none ScalaDTransform anonymous RCE.""" from future import annotations import json import time import uuid from kittysploit import from...

Laquis SCADA unauth uploade CMDEXT DLL autoload RCE

Unauthenticated POST /uploade.html writes CMDEXT.DLL; optional GET /reset.html forces restart so mili loads the DLL DllMain runs on attach. """LCDS Laquis SCADA — Unauthenticated /uploade.html File Write + Startup CMDEXT.DLL Autoload = Pre-Auth RCE CVSS 9.8""" from future import annotations impor...

Syncrify PublicLink chunk upload traversal cron root RCE

Backup user PublicLink auth then binary chunk upload st=u with traversing chunk name writes /etc/cron.d/. """Syncrify PublicLink chunk upload path traversal cron root RCE.""" from future import annotations import re import struct import time from urllib.parse import quote from kittysploit import...

Raritan EMX port_mux config injection root RCE

Login → download config → inject protolistenerhttp program=/bin/sh → upload → TCP connect triggers execv as root. """Raritan EMX authenticated portmux protolistener config injection root RCE.""" from future import annotations import re import socket import time import uuid from urllib.parse impor...

nanoDLP Unauthenticated Root RCE via G-code Injection — Detect

Fingerprint / reachability check for nanoDLP Unauthenticated Root RCE via G-code Injection !/usr/bin/env python3 -- coding: utf-8 -- """Detection for nanoDLP Unauthenticated Root RCE via G-code Injection""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

DrayTek Vigor 2960 uploadlangs command injection root RCE

Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE multi platform.""" from future import annotations import uuid from kittysploit import...

VitalPBX — Authenticated Root RCE via asterisk_cli → dialplan System() (Privileg — Detect

Fingerprint / reachability check for VitalPBX — Authenticated Root RCE via asteriskcli → dialplan System Privilege Escalation !/usr/bin/env python3 -- coding: utf-8 -- """Detection for VitalPBX — Authenticated Root RCE via asteriskcli → dialplan System Privilege Escalation""" from kittysploit...

Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xp_cmdshell RCE — Detect

Fingerprint / reachability check for Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xpcmdshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Inflectra SpiraTeam — PlanningBoard yAxisKey SQLi → xpcmdshell RCE""" from kittysploit import from lib.protocols.http.httpclient impor...

Lansweeper LicenseActions Second-Order SQL Injection Authenticated RCE — Detect

Fingerprint / reachability check for Lansweeper LicenseActions Second-Order SQL Injection Authenticated RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lansweeper LicenseActions Second-Order SQL Injection Authenticated RCE""" from kittysploit import from lib.protocols.http.httpclie...

Plixer Scrutinizer adminEditLang SQLi pg_cron RCE

Authenticated adminEditLang orderBy SQL injection schedules cron.scheduleindatabase COPY TO PROGRAM PostgreSQL/pgcron. """Plixer Scrutinizer adminEditLang ORDER BY SQLi to pgcron RCE.""" from future import annotations import re import time from urllib.parse import urlencode from kittysploit impor...

LCDS Laquis SCADA — Unauthenticated `/uploade.html` File Write + Startup `CMDEXT — Detect

Fingerprint / reachability check for The web/HMI component of LCDS Laquis SCADA, mili.exe PE32 Delphi console, 1129984 bytes, listening on 0.0.0.0:11234 per var.ini MODE PORT=11234, plus Modbus TCP on 0.0.0.0:502, routes roug !/usr/bin/env python3 -- coding: utf-8 -- """Detection for LCDS Laquis...

Voicent SaveFileServlet unauthenticated JSP RCE

Unauthenticated multipart POST /savefile.jsp with forwardpage auth bypass writes a JSP under the web root; subsequent GET executes arbitrary commands. """Voicent Call Center SaveFileServlet unauthenticated JSP upload RCE.""" from future import annotations import uuid from urllib.parse import quot...

Vicon Valerus unauthenticated command injection RCE

Unauthenticated POST to /NVR/api/v1/upgrades/multiformat-file-Execute/start with a JSON-encoded command string triggers OS command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Vicon Valerus unauthenticated command injection RCE.""" from future import annotations import json import re...

Edimax BR-6478AC v2.20 - Authenticated Command Injection in the formWlanMP Manuf — Detect

Fingerprint / reachability check for Edimax BR-6478AC v2.20 - Authenticated Command Injection in the formWlanMP Manufacturing-Test Handler Reaching root Command Execution CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Edimax BR-6478AC v2.20 - Authenticated Command Injection in...

Wyn Enterprise unauthenticated token forgery provider load root RCE

Forged integration JWT → admin reference token → admin/api/import Zip-Slip EvilProvider.dll → security-providers reload. """Wyn Enterprise token forgery import Zip-Slip EvilProvider load root RCE.""" from future import annotations import base64 import io import json import re import zipfile from...

Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE — Detect

Fingerprint / reachability check for Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix SGX5150 — Authenticated Command Injection in FsBrowseClean → Root RCE""" from kittysploit import from...

Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE — Detect

Fingerprint / reachability check for Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Brekeke PBX — Unauthenticated XmlTransBean Util.exec RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the Web

Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor Application CWE-306, CWE-78 """Titan MFT Server 26.0.0 - Unauthenticated First-Run Administrator Setup Chained to Job Post-Command Injection in the WebAdmin Blazor...

Biamp Vocia MS-1 FTPS hardcoded cred root RCE

FTPS ftpsuser/ftpsuser → Bins/ upload filename injection or astmon replacement → mum executes as root. """Biamp Vocia MS-1 Unauthenticated Root RCE via Hardcoded FTPS Credentials""" from future import annotations from kittysploit import from ftplib import FTPTLS, errorperm, errortemp import io...

Dataedo Portal Hangfire scheduler SQL injection RCE

Portal login → repository connection-string → SQL inject Hangfire job Process.Start requires sqlcmd to agent DB. """Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 - Unrestricted Job-Type Deserialization in the Agent Scheduler Storage, Reached Through the Repository Connection-String API CWE-502"...

Stimulsoft Server unauth report script RCE

Open /1/signup → Supervisor session → malicious .mrt upload via /1/runcommand → PUT /1/reporttemplates//run C compilation as SYSTEM. """Stimulsoft Server unauthenticated report script compilation RCE Windows.""" from future import annotations import base64 import json import os import re import...

Output Messenger Server Unauthenticated Zip-Slip Plugin Planting RCE

Output Messenger Server Unauthenticated Zip-Slip Plugin Planting RCE """Output Messenger Server Unauthenticated Zip-Slip Plugin Planting RCE""" from future import annotations from kittysploit import import socket, zipfile, time, sys, os, io, random, string, base64, re import struct import time...

NoMachine Terminal Server — Pre-Authentication Stack Overflow with Return-Address (RIP) Control

NoMachine Terminal Server — Pre-Authentication Stack Overflow with Return-Address RIP Control """NoMachine Terminal Server — Pre-Authentication Stack Overflow with Return-Address RIP Control""" from future import annotations from kittysploit import import os import socket import ssl import sys...

webMethods MSR XSLT Xalan default credentials RCE

Administrator/manage Basic auth; SSRF to attacker-hosted evil.xsl via transformSerialXML. """webMethods MSR default creds XSLT Xalan Java extension RCE.""" from future import annotations import base64 import html import http.server import re import socketserver import threading import time from...

TigerGraph Community Edition 4.2.4 — Default Hard-Coded Credentials + GSQL Arbit — Detect

Fingerprint / reachability check for TigerGraph Community Edition 4.2.4 — Default Hard-Coded Credentials + GSQL Arbitrary File Write + Unauthenticated REST++ Trigger → SSH RCE as tigergraph !/usr/bin/env python3 -- coding: utf-8 -- """Detection for TigerGraph Community Edition 4.2.4 — Default...

Accusoft / Apryse PrizmDoc for Java (VirtualViewer) 5.22.1 — Unauthenticated `up — Detect

Fingerprint / reachability check for Accusoft / Apryse PrizmDoc for Java VirtualViewer 5.22.1 — Unauthenticated uploadDocument Arbitrary File Write to JSP Webshell to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Accusoft / Apryse PrizmDoc for Java VirtualViewer 5.22.1 —...

MAPS SCADA WSDataProvider.Login BinaryFormatter unauth RCE

Login SOAP zippedUserDetails deserializes BinaryFormatter gadget embedded whoami proof file on Windows. """MAPS SCADA WSDataProvider.Login unauthenticated BinaryFormatter RCE.""" from future import annotations import base64 import gzip import re from kittysploit import from...

mySCADA PRO Runtime — Unauthenticated `upgrade` Branch Command Injection → Root — Detect

Fingerprint / reachability check for mySCADA PRO Runtime — Unauthenticated upgrade Branch Command Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for mySCADA PRO Runtime — Unauthenticated upgrade Branch Command Injection → Root RCE""" from kittysploit import from...

iMonnit Express Unauthenticated Auth Bypass + Path Traversal + Plugin Load SYSTE — Detect

Fingerprint / reachability check for iMonnit Express Unauthenticated Auth Bypass + Path Traversal + Plugin Load SYSTEM RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for iMonnit Express Unauthenticated Auth Bypass + Path Traversal + Plugin Load SYSTEM RCE""" from kittysploit import fr...

Seeq self-registration Data Lab Jupyter missing auth Python RCE

Unauth POST /api/users, login, spawn Data Lab Jupyter, execute Python via kernel WebSocket channels. """Seeq unauthenticated self-registration Data Lab Jupyter kernel RCE.""" from future import annotations import base64 import json import os import socket import struct import time import uuid fro...

Seeq Server — Unauthenticated Self-Registration + Data Lab Jupyter Missing Autho — Detect

Fingerprint / reachability check for Seeq Server — Unauthenticated Self-Registration + Data Lab Jupyter Missing Authorization → Arbitrary Python RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Seeq Server — Unauthenticated Self-Registration + Data Lab Jupyter Missing Authorization ...

Edimax BR-6478AC formWlanMP command injection root RCE

HTTP Basic POST /goform/formWlanMP — command substitution in ateFunc or other fields reaches system as root. """Edimax BR-6478AC formWlanMP authenticated command injection root.""" from future import annotations import base64 import re from urllib.parse import urlencode from kittysploit import fr...

Akana API Platform — Path-Normalization Filter/Dispatcher Discrepancy → Unauthen — Detect

Fingerprint / reachability check for Akana API Platform — Path-Normalization Filter/Dispatcher Discrepancy → Unauthenticated RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Akana API Platform — Path-Normalization Filter/Dispatcher Discrepancy → Unauthenticated RCE""" from kittysplo...

CacheGuard — Authenticated Config-Import Eval Injection → RCE — Detect

Fingerprint / reachability check for CacheGuard — Authenticated Config-Import Eval Injection → RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CacheGuard — Authenticated Config-Import Eval Injection → RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Netsis NetOpenX token endpoint SQLi xp_cmdshell RCE

Unauthenticated POST /api/v2/token idmuserid parameter stacked SQL enables xpcmdshell on the backend SQL Server. """Logo Netsis NetOpenX OAuth token SQLi to xpcmdshell RCE.""" from future import annotations import re import time from urllib.parse import urlencode from kittysploit import from...

Loadbalancer.org ADC deployment template injection RCE

Config-group Basic auth POST to /lbadmin/config/deployment/index.php with base64 deployment JSON injects into haproxy reload sudo NOPASSWD. !/usr/bin/env python3 -- coding: utf-8 -- """Loadbalancer.org ADC deployment template command injection root.""" from future import annotations import base64...

DrayTek Vigor uploadlangs command injection root RCE

Authenticated language pack upload: filename passes cgiEscape only & then systemmv ... with ; injection. !/usr/bin/env python3 -- coding: utf-8 -- """DrayTek Vigor uploadlangs filename command injection root RCE.""" from future import annotations import uuid from kittysploit import from...

Ecava IntegraXor FileUpload dxmanager RCE

Unauthenticated /FileUpload writes a .bat and JSON task descriptor; dxmanager runs cmd.exe /C on meta.name after service reload. """Ecava IntegraXor unauth FileUpload → dxmanager cmd.exe RCE.""" from future import annotations import json import re import time from kittysploit import from...

GeoVision SNMPv3 authKey injection root RCE

LAPI Digest admin: szAuthKey injected into net-snmp-config system sink classic '; cmd ; ' on TBL4700. """GeoVision GV-TBL4700 — SNMPv3 User Config → net-snmp-config Command Injection → Root RCE""" from future import annotations import json from kittysploit import from lib.protocols.http.httpclien...

Akana scriptTestServ unauthenticated RCE

GET /admin/../ext/scriptTestServ?action=testScript executes base64-encoded BeanShell/Jython/Nashorn as the platform user. """Akana scriptTestServ path normalization bypass unauth script RCE.""" from future import annotations import base64 import re from urllib.parse import quote from kittysploit...

Devolutions Server test-script PAM gate bypass RCE

Administrator login then POST /api/pam/provider-templates/test-script with PamSystemVault GUID in query bypasses entitlement gate and runs PowerShell. """Devolutions Server PAM gate bypass + test-script PowerShell SYSTEM RCE.""" from future import annotations import json import re from kittysploi...

Leostream unauthenticated Server.Register rogue agent + SSRF

Frontier RPC2 Server.Register without auth injects VM record; optional callback IP/port triggers outbound Agent.Connect SSRF. """Leostream Connection Broker unauthenticated Server.Register + SSRF.""" from future import annotations import hashlib import re from xml.sax.saxutils import escape from...

Xeams SQLRunner Derby hardcoded creds JSP RCE

Unauthenticated SQLRunner.jsp connects to embedded Derby with default credentials, SYSCSEXPORTQUERY writes JSP under webapps/ROOT, GET runs cmd. """Xeams SQLRunner.jsp unauthenticated Derby export → JSP webshell RCE.""" from future import annotations import random import re from urllib.parse impo...

JetBrains Datalore On-Premises Unauthenticated RCE via InteractiveReport READ-to-EXECUTE Access Mapping Flaw

JetBrains Datalore On-Premises Unauthenticated RCE via InteractiveReport READ-to-EXECUTE Access Mapping Flaw """JetBrains Datalore On-Premises Unauthenticated RCE via InteractiveReport READ-to-EXECUTE Access Mapping Flaw""" from future import annotations from kittysploit import from http.server...

NoMachine Terminal Server — Pre-Authentication Heap Memory Corruption in parsePOST

NoMachine Terminal Server — Pre-Authentication Heap Memory Corruption in parsePOST """NoMachine Terminal Server — Pre-Authentication Heap Memory Corruption in parsePOST""" from future import annotations from kittysploit import import socket import ssl import sys import time import re import os...

AdRem NetCrunch Startup Script RCE — Detect

Fingerprint / reachability check for AdRem NetCrunch Startup Script RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for AdRem NetCrunch Startup Script RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 - Unrestricted Job-Type Deserial — Detect

Fingerprint / reachability check for Dataedo Portal 26.2.8 with Dataedo Agent 26.2.8 - Unrestricted Job-Type Deserialization in the Agent Scheduler Storage, Reached Through the Repository Connection-String API CWE-502 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Dataedo Portal 26.2....

HiveMQ Platform Data Hub Zip-Slip to Root RCE — Detect

Fingerprint / reachability check for HiveMQ Platform Data Hub Zip-Slip to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for HiveMQ Platform Data Hub Zip-Slip to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Leostream Connection Broker — Authenticated SQL Injection → lo_export Webshell → — Detect

Fingerprint / reachability check for Leostream Connection Broker — Authenticated SQL Injection → loexport Webshell → sudo Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Leostream Connection Broker — Authenticated SQL Injection → loexport Webshell → sudo Root RCE""" from...

Loadbalancer.org ADC Deployment Template Command Injection to Root RCE — Detect

Fingerprint / reachability check for Loadbalancer.org ADC Deployment Template Command Injection to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Loadbalancer.org ADC Deployment Template Command Injection to Root RCE""" from kittysploit import from lib.protocols.http.httpclie...