Stage Cache (Zig)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Stage Verify (Zig)

Verify staged artifact SHA256 before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify Zig", "description": "Verify staged artifact SHA256 before callback", "author"...

Adobe Campaign Classic CVE-2026-83660 Detect

Detects Adobe Campaign Classic ACC instances likely affected by CVE-2026-83660 unauthenticated SSRF / privilege escalation and CVE-2026-89276 low-privilege code injection. Fingerprints ACC JSP surfaces and parses build numbers from /r/test against the APSB26-142 fixed build 7.4.4.9402...

Cisco ISE CVE-2026-76460 Auth Bypass Detect

Detects Cisco Identity Services Engine ISE management nodes exposed to CVE-2026-76460. Fingerprints the admin login panel, then probes protected ERS/API paths without credentials. Any HTTP 2xx on /ers/config/ or /admin/API/ without redirect to login indicates the ise-kong bypass surface...

Citrix NetScaler CVE-2026-88773 Detect

Detects Citrix NetScaler ADC/Gateway builds likely affected by CVE-2026-88773 HTTP request/response smuggling, CWE-444. Confirms NetScaler presence and parses appliance firmware against CTX697096 fixed builds 14.1-73.37+, 13.1-64.23+. Does not send smuggling probes. !/usr/bin/env python3 -- codin...

Magento CVE-2026-71362 Account Takeover Detect

Detects CVE-2026-71362 in Adobe Commerce / Magento Open Source before the APSB26-92 August 2026 patch: failed customer editPost poisons customerformdata and mass-assigns id into the active session. Registers a throwaway account and attempts a benign identity switch. !/usr/bin/env python3 -- codin...

Magento CVE-2026-75650 StyleSmuggler Detect

Detects CVE-2026-75650 StyleSmuggler in Adobe Commerce / Magento Open Source before hotfix VULN-39341: unauthenticated /graphql requests accept attacker-controlled styles gadget parameters used to evaluate PHP through the email template engine. !/usr/bin/env python3 -- coding: utf-8 -- """Detect...

PaperCut CVE-2026-81578 Auth Bypass Detect

Detects CVE-2026-81578 in PaperCut NG/MF before 24.1.10 / 25.0.13 / 26.0.5. Apache Tapestry direct/1/Home/ConfigEditor requests validate only the render page Home while invoking privileged ConfigEditor listeners without a session. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PaperCut...

Sangoma Switchvox CVE-2026-9586 SQLi Detect

Detects CVE-2026-9586 in Sangoma Switchvox SMB before 8.4.0.2. The unauthenticated /pa phone-notification endpoint concatenates XML PhoneIP values into PostgreSQL queries. Uses a benign syntax-error probe only. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Sangoma Switchvox CVE-2026-9586...

WordPress Core CVE-2026-87902 Page Template LFI Detect

Detects CVE-2026-87902 in WordPress Core 4.7.0 through 7.1.1: getpagetemplate decodes pagename without validatefile, enabling unauthenticated local .php inclusion when the active theme exposes a top-level page- directory e.g. page-templates/. Fixed in 7.1.2. !/usr/bin/env python3 -- coding: utf-8...

WSO2 CVE-2026-5430 JWT Auth Bypass Detect

Detects CVE-2026-5430 in WSO2 API Manager / Control Plane / Traffic Manager / Universal Gateway: JWTUtil accepts tokens whose alg header is outside the supported RS256/384/512 set. Probes admin APIs with an alg:none X-JWT-Assertion. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WSO2...

Fortinet FortiOS CVE-2025-25249 CAPWAP Detect

Detects CVE-2025-25249 exposure by probing UDP/5246 with a benign CAPWAP Discovery Request. A response from cwacd indicates the fabric/CAPWAP control plane is reachable; combine with FortiOS version inventory to assess patch status fixed in 7.6.4 / 7.4.9 / 7.2.12 / 7.0.18 / 6.4.17. !/usr/bin/env...

Cisco Secure Email CVE-2026-76461 Detect

Detects on-prem Cisco Secure Email Gateway AsyncOS appliances exposed to CVE-2026-76461 pre-authentication SQL injection in email parsing. Fingerprints the ESA/IronPort login panel and parses AsyncOS release markers to flag branches before fixed builds 15.5.5-014 / 16.0.4-302 / 16.5.0-780...

Citrix NetScaler CVE-2026-88771 Detect

Detects Citrix NetScaler ADC/Gateway instances likely affected by CVE-2026-88771. Confirms NetScaler presence, parses appliance build when exposed, and checks whether the AAA login path accepts the pitboss/PPE log trigger pattern used by nsmonuploadderr.pl. !/usr/bin/env python3 -- coding: utf-8 ...

F5 BIG-IP CVE-2026-94127 APM OAuth Detect

Detects CVE-2026-94127 exposure when a BIG-IP virtual server combines an APM access policy with an OAuth Authorization Server profile. Probes the OAuth UserInfo endpoint for expected invalidtoken responses and parses BIG-IP version hints from /mgmt/tm/sys/version when reachable. !/usr/bin/env...

JFrog Artifactory CVE-2026-82329 Detect

Detects CVE-2026-82329: default Artifactory installs register a blank additional join key, allowing unauthenticated POST /access/api/v1/registry/join with an HS256 JWT signed using the publicly derivable 32-byte padded key. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JFrog Artifactory...

N-able N-central CVE-2026-86218 Detect

Detects N-able N-central builds before 2026.3.1.14 Hotfix 4 that expose the pre-authentication /remoteControlAction.do?method=getPierDetails reconnaissance endpoint associated with CVE-2026-86218 static code injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect N-able N-central...

Zyxel GS1900 CVE-2026-7273 Detect

Detects Zyxel GS1900 smart-managed switches running firmware 2.90XXXX.1C0 or earlier, vulnerable to CVE-2026-7273 stack-based buffer overflow in the web-management CGI program. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zyxel GS1900 CVE-2026-7273 CGI stack buffer overflow exposure."""...

Netcore NR289-GE CVE-2026-101072 ap_ip.cgi RCE

Exploits CVE-2026-101072 via POST /x.ico/apip.cgi on Netcore NR289-GE AC controllers. The ip form field breaks out of a wget --post-data shell command. Requires a bound AP MAC; payload length is limited to 19 bytes. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NR289-GE CVE-2026-101072...

Magento StyleSmuggler Unauthenticated RCE (CVE-2026-75650)

Exploits CVE-2026-75650 StyleSmuggler via a two-stage unauthenticated chain: poison var/report through /paypal/transparent/response/, then trigger template evaluation through /graphql styles gadget parameters no email delivery required. !/usr/bin/env python3 -- coding: utf-8 -- """Magento / Adobe...

Sangoma Switchvox CVE-2026-9586 /pa SQLi RCE

Exploits CVE-2026-9586 via the unauthenticated /pa XML phone-notification endpoint. Injects stacked PostgreSQL into the PhoneIP field and uses COPY ... TO PROGRAM to run a shell command as the database superuser. !/usr/bin/env python3 -- coding: utf-8 -- """Sangoma Switchvox CVE-2026-9586...

Resource Guard (PowerShell)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard PowerShell", "description": "Exit early whe...

Network Preflight (PowerShell)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight PowerShell", "description": "Probe callback...

Signed Config (PowerShell)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Telemetry Buffer (PowerShell)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Capability Probe (Python)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Python",...

Resource Guard (Python)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard Python", "description": "Exit early when...

Stage Verify (Python)

Verify staged artifact SHA256 before callback uses stagecache when present !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "stageverify" info = "name": "Stage Verify Python", "description": "Verify staged artifact...

Capability Probe (Zig)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe Zig",...

Resource Guard (Zig)

Exit early when memory or disk looks too constrained for the intended target !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "resourceguard" info = "name": "Resource Guard Zig", "description": "Exit early when memor...

Telemetry Buffer (Zig)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Check Point CVE-2026-85102 VPN Detect

Detects Check Point Security Gateway / Spark firewall exposure to CVE-2026-85102: improper certificate validation during Site-to-Site or Remote Access VPN negotiation sk1000117. Fingerprints SSL VPN / Mobile Access login surfaces and flags builds before fixed JHF takes. !/usr/bin/env python3 --...

Citrix NetScaler CVE-2026-19490 Detect

Detects Citrix NetScaler ADC/Gateway deployments likely exposed to CVE-2026-19490 SAML alternate-path authentication bypass. Requires Gateway/AAA virtual server usage; flags affected 13.1/14.1 builds before 13.1-63.21 / 14.1-73.32 and reachable SAML endpoints. !/usr/bin/env python3 -- coding: utf...

Netcore NAP930 CVE-2026-102240 Detect

Detects CVE-2026-102240 in Netcore NAP930 access points: pre-auth command injection in /cgi-bin/networktools via eval on raw QUERYSTRING before the sid session check. Confirms endpoint presence and optionally writes a marker file to /www/ when activeprobe is enabled. !/usr/bin/env python3 --...

Arista VeloCloud CVE-2026-93952 Detect

Detects on-prem VeloCloud Orchestrator VCO exposure to CVE-2026-93952 before fixed releases 5.2.3.16 / 6.4.2.8. The flaw allows unauthenticated access to privileged internal functionality when certificate-based Edge authentication is enabled. Fingerprints the VCO portal and parses version markers...

SharePoint CVE-2026-65660 ToolPane Detect

Detects on-prem SharePoint farms exposed to CVE-2026-65660: ToolPane Register directive quote injection on AddGallery/ToolPane endpoints. Fingerprints MicrosoftSharePointTeamServices build and reachable layouts/15/ gallery edit surfaces without sending exploit markup. !/usr/bin/env python3 --...

SonicWall SMA1000 CVE-2026-83548 SSRF Detect

Detects CVE-2026-83548 in SonicWall SMA1000 WorkPlace before hotfixes 12.4.3-03526 / 12.5.0-02952. Sends an unauthenticated absolute-form OPTIONS request that WorkPlace forwards to loopback CouchDB; a 405 methodnotallowed JSON body confirms the SSRF primitive. !/usr/bin/env python3 -- coding: utf...

Check Point CVE-2026-93616 Management Detect

Detects exposure to CVE-2026-93616 on Check Point Quantum Security Management SmartConsole/SMS before R82.20 / JHF takes listed in sk1000171. Fingerprints the management web service on TCP/19009 and reachable HTTPS management panels without sending exploit upload payloads. !/usr/bin/env python3 -...

Netcore NAP930 CVE-2026-102240 network_tools RCE

Exploits CVE-2026-102240 in Netcore NAP930 via GET /cgi-bin/networktools?sid=';CMD;:'. The shell CGI evals QUERYSTRING before the session-id authorization check. Quotes and semicolons must be sent raw not URL-encoded. !/usr/bin/env python3 -- coding: utf-8 -- """Netcore NAP930 CVE-2026-102240...

JFrog Artifactory CVE-2026-42016 Token Escalation

Chains CVE-2026-42018 anonymous JWT acquisition with CVE-2026-42016: POST /access/api/v1/tokens accepts a low-privilege token and returns an admin-scoped token when scope validation checks signature/issuer only. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory CVE-2026-42016 scope...

ILIAS <= 9.21 / 10.9 / 11.2 - PHP Object Injection RCE (CVE-2026-80428)

Unauthenticated PHP object injection in ILIAS via ltiauth.php session seeding and shiblogout.php SOAP LogoutNotification mass-unserialize. Chains GuzzleHttp\Cookie\FileCookieJar to write a webshell under the ILIAS docroot. Fixed in ILIAS 9.22 / 10.10 / 11.3. Packaged ILIAS 11.x shiblogout.php is...

Capability Probe (PowerShell)

Detect OS, architecture, runtime, privileges, writable directory, and network capabilities before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "capabilityprobe" info = "name": "Capability Probe...

WordPress Core CVE-2026-87902 Page Template LFI/RCE

Exploits CVE-2026-87902 when the active theme contains a page- directory and pearcmd.php is readable with registerargcargv enabled. Stage 1 uses double-encoded pagename traversal to include pearcmd and write a webroot marker; stage 2 executes verifycmd through the dropped PHP file. !/usr/bin/env...

Network Preflight (Python)

Probe callback reachability before entering the main implant loop !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "networkpreflight" info = "name": "Network Preflight Python", "description": "Probe callback...

Stage Cache (Python)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Telemetry Buffer (Python)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Scope Guard (Zig)

Exit when the callback host is outside the embedded lab scope !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "scopeguard" info = "name": "Scope Guard Zig", "description": "Exit when the callback host is outside the...

Acronis Backup CVE-2026-87886 Detect

Detects Acronis Backup integrations on cPanel/WHM, Plesk, or DirectAdmin that may be affected by CVE-2026-87886 insecure file permissions enabling local privilege escalation. Fingerprints the plugin surface and parses build numbers against fixed releases cPanel 1.9.3.1021, Plesk 1.8.11.638,...

Froxlor CVE-2026-100717 CRLF Detect

Detects Froxlor server administration panels affected by CVE-2026-100717 Validate::validateUrl CRLF in userinfo. Versions 2.3.10 and earlier allow authenticated customers with subdomain rights to inject nginx/Apache directives via redirect URLs. Fingerprints Froxlor and compares reported version...