RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer `sid` Parameter (C — Detect

Fingerprint / reachability check for RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for RCDevs WebADM 2.4.14 - OS Command Injection in the Log Viewer sid Parameter CWE-78""" from kittysploit import from...

vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE — Detect

Fingerprint / reachability check for vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for vMix 29 ScriptStartDynamic VBScript Blocklist Bypass RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Xeams SQLRunner.jsp Unauthenticated Derby Hardcoded Cred JSP Webshell RCE — Detect

Fingerprint / reachability check for Xeams SQLRunner.jsp Unauthenticated Derby Hardcoded Cred JSP Webshell RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Xeams SQLRunner.jsp Unauthenticated Derby Hardcoded Cred JSP Webshell RCE""" from kittysploit import from...

Edimax BR-6478AC setWAN command injection root RCE

HTTP Basic auth POST /goform/setWAN — pppUserName/pptpUserName/L2TPUserName injected into system pipeline as root boa User root. """Edimax BR-6478AC setWAN authenticated command injection root.""" from future import annotations import base64 from urllib.parse import urlencode from kittysploit...

Advantech WebAccess CrystalRpt unauth ASPX upload RCE

Unauthenticated CrystalRpt.aspx path traversal upload writes ASPX under IIS app root; invoke via ?c= for cmd.exe execution reverse shell via set payload. """Advantech WebAccess CrystalRpt.aspx unauthenticated upload → ASPX RCE.""" from future import annotations import posixpath import re import...

Altus BluePlant hardcoded Connect bypass RunProcess RCE

Forge Connect pass via ForgePass.exe vendor TCryptoStream, acquire connectionHandle with user getserviceinfo, then SendRequest RunProcess. """Altus BluePlant Hardcoded Credentials RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient...

CacheGuard config import eval injection RCE

Admin login and multipart upload to /gui/conf-load-save.apl injects $cmd into config; transaction commit eval executes as admin. !/usr/bin/env python3 -- coding: utf-8 -- """CacheGuard authenticated config import eval injection RCE.""" from future import annotations import re from urllib.parse...

Circutor LineEds pwrstudio shellExecute unauth RCE

PUT/POST armed events.xml then GET restart/reloadCfg; sink runs system"x ;CMD;" as root on many deployments. """Circutor LineEds pwrstudio unauthenticated shellExecute event injection RCE.""" from future import annotations import re from kittysploit import from lib.protocols.http.httpclient impor...

DBxtra .NET unauthenticated SOAP xp_cmdshell RCE

Unauthenticated DBxtraService.asmx chains ProjectConnectionInsertDB, ProjectObjectInsertDB xpcmdshell SQL, UpdateDatabaseVersion, and DataGrid.aspx viewer execution. !/usr/bin/env python3 -- coding: utf-8 -- """DBxtra .NET unauthenticated SOAP xpcmdshell RCE.""" from future import annotations...

GigaSpaces XAP unauth path traversal JSP RCE

Benign upload then clientId traversal writes shell.jsp to gs-webui webapp root; GET /shell.jsp?cmd= executes commands. """GigaSpaces XAP unauthenticated fileUpload traversal JSP RCE.""" from future import annotations import uuid from urllib.parse import quote from kittysploit import from...

ksqlDB unauthenticated CREATE SINK CONNECTOR cron root RCE

UNAUTH POST /ksql creates FileStreamSinkConnector writing /etc/cron.d/; produce cron line on Kafka topic 9092 for root execution. !/usr/bin/env python3 -- coding: utf-8 -- """Confluent ksqlDB unauthenticated FileStreamSinkConnector cron root RCE.""" from future import annotations import json impo...

Parasoft CTP deserialization restore path JSP RCE

Anonymous POST database/restore;welcome with malicious backup.zip deserializes gadget chain writing JSP under webapp images; GET executes. """Parasoft Continuous Testing Platform 10.7.5-SNAPSHOT - Unfiltered Java Deserialization in the Database Restore Path Behind a Raw-URI License Gate Bypass an...

Puppet Enterprise keytool shell injection root RCE

RBAC token → classifier PE Master group → javakeystorepasswd injection + trustedinfracacert trigger; orchestrator deploy runs agent. """Puppet Enterprise classifier keytool passwd injection CVE-2025-5459 variant.""" from future import annotations import json import re from kittysploit import from...

Inflectra SpiraTeam PlanningBoard yAxisKey SQLi RCE

Authenticated PlanningBoardMoveItems yAxisKey SQL injection reaches REQUIREMENTRETRIEVECUSTOM EXEC@SQL and xpcmdshell Windows. !/usr/bin/env python3 -- coding: utf-8 -- """Inflectra SpiraTeam PlanningBoard yAxisKey SQLi to xpcmdshell RCE.""" from future import annotations import json import re...

DSE Gremlin-Groovy sandbox bypass RCE

Unauthenticated Gremlin WebSocket: this.evaluate nested ProcessBuilder bypass. """DataStax Enterprise DSE Gremlin-Groovy Sandbox Bypass Unauthenticated RCE""" from future import annotations from kittysploit import import base64 import hashlib import json import os import secrets import socket...

ObjectDB JDOQL Filter Injection to Root RCE

ObjectDB JDOQL Filter Injection to Root RCE """ObjectDB JDOQL Filter Injection to Root RCE""" from future import annotations from kittysploit import import os import socket import struct import subprocess import sys import tempfile import time import re import subprocess import tempfile import os...

Xeams SMTP save-body cron root RCE

X-SMSAVEBODY4DEBUGGING writes arbitrary file; base64 body plants /etc/cron.d job running payload as root. """Xeams SMTP X-SMSAVEBODY4DEBUGGING Arbitrary File Write Cron Root RCE""" from future import annotations from kittysploit import import base64 import socket import sys import time import re...

Ecava IntegraXor IGX — Unauthenticated /FileUpload Arbitrary Write Chained to dx — Detect

Fingerprint / reachability check for Ecava IntegraXor IGX — Unauthenticated /FileUpload Arbitrary Write Chained to dxmanager cmd.exe /C Sink: Administrator RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Ecava IntegraXor IGX — Unauthenticated /FileUpload Arbitrary Write Chained to...

Ontotext GraphDB .pie Ruleset Namespace Prefix Injection Unauthenticated Root RC — Detect

Fingerprint / reachability check for Ontotext GraphDB .pie Ruleset Namespace Prefix Injection Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Ontotext GraphDB .pie Ruleset Namespace Prefix Injection Unauthenticated Root RCE""" from kittysploit import from...

IPConfigure Orchid VMS — Authenticated Command Injection in the DNF Repository G — Detect

Fingerprint / reachability check for IPConfigure Orchid VMS — Authenticated Command Injection in the DNF Repository GPG-Key Import Path root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for IPConfigure Orchid VMS — Authenticated Command Injection in the DNF Repository GPG-Key Import...

Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE — Detect

Fingerprint / reachability check for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Confluent Platform ksqlDB Unauthenticated CREATE SINK CONNECTOR to Root RCE""" from kittysploit import from...

Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Regist — Detect

Fingerprint / reachability check for Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Registration + SSRF !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Leostream Connection Broker — Unauthenticated Server.Register Rogue-Agent Registration + SSRF""" from...

Maian Cart 3.8 — Unrestricted `addBanners` Banner Upload Enables Webshell Write — Detect

Fingerprint / reachability check for Maian Cart 3.8 — Unrestricted addBanners Banner Upload Enables Webshell Write and RCE Administrator Session Required !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Maian Cart 3.8 — Unrestricted addBanners Banner Upload Enables Webshell Write and RC...

Royal Server — Authenticated Local Privilege Escalation to LocalSystem — Detect

Fingerprint / reachability check for Royal Server — Authenticated Local Privilege Escalation to LocalSystem !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Royal Server — Authenticated Local Privilege Escalation to LocalSystem""" from kittysploit import from lib.protocols.http.httpclie...

StreamSets Transformer 3.17.0 — "none" Authentication Mode Fallback + Un-sandbox — Detect

Fingerprint / reachability check for StreamSets Transformer 3.17.0 — "none" Authentication Mode Fallback + Un-sandboxed ScalaDTransform Code Execution → Anonymous Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for StreamSets Transformer 3.17.0 — "none" Authentication Mode Fallbac...

Teltonika RutOS ipsec status logread injection — Detect

Fingerprint RutOS VuCI web UI and ipsec/openvpn API surface for authenticated logread command-injection advisory. !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Teltonika RutOS ipsec status logread command injection.""" from kittysploit import from lib.protocols.http.httpclient import...

Wavestore VMS venusd /simple/export Command Injection to Root RCE — Detect

Fingerprint / reachability check for Wavestore VMS venusd /simple/export Command Injection to Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Wavestore VMS venusd /simple/export Command Injection to Root RCE""" from kittysploit import from lib.protocols.http.httpclient import...

SonicWall SMA 1000 Pre-Auth Deserialization RCE Chain — Detect

Fingerprint / reachability check for SonicWall SMA 1000 Pre-Auth Deserialization RCE Chain !/usr/bin/env python3 -- coding: utf-8 -- """Detection for SonicWall SMA 1000 Pre-Auth Deserialization RCE Chain""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Voicent Call Center SaveFileServlet Unauthenticated Root RCE — Detect

Fingerprint / reachability check for Voicent Call Center SaveFileServlet Unauthenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Voicent Call Center SaveFileServlet Unauthenticated Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

atvise WebMI default-credential root RCE

Factory empty root password: WebMI loginroot, → AddNode ScriptCode → ReportRunConfiguration executes ChildProcess as root. """atvise SCADA WebMI default-credential root RCE AddNode ScriptCode.""" from future import annotations import json import random import hashlib import urllib.parse from...

Maian Gallery authenticated admin upload PHP webshell RCE

Admin login then cmd=addimages thumb upload writes picN-cat.php under content/galleries///. """Maian Gallery admin thumbnail upload PHP webshell RCE.""" from future import annotations import re import uuid from urllib.parse import quote, urlencode from kittysploit import from...

OSNexus QuantaStor — alertConfigSet smtpPassword Command Injection → Root RCE — Detect

Fingerprint / reachability check for OSNexus QuantaStor — alertConfigSet smtpPassword Command Injection → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for OSNexus QuantaStor — alertConfigSet smtpPassword Command Injection → Root RCE""" from kittysploit import from...

vMix ScriptStartDynamic blocklist bypass RCE

Unauthenticated GET /api/?Function=ScriptStartDynamic&Value=... runs attacker VB.NET that calls Process.Startcmd.exe, /c .... !/usr/bin/env python3 -- coding: utf-8 -- """vMix ScriptStartDynamic VB.NET blocklist bypass RCE.""" from future import annotations import re from urllib.parse import quot...

Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leadin — Detect

Fingerprint / reachability check for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx Leading to Code Execution in the IIS Worker Process !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Advantech WebAccess Node — Unauthenticated File Upload in CrystalRpt.aspx...

Minuteman UPS NMC — Unauthenticated Command Injection in system_param.csp → Root — Detect

Fingerprint / reachability check for Minuteman UPS NMC — Unauthenticated Command Injection in systemparam.csp → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Minuteman UPS NMC — Unauthenticated Command Injection in systemparam.csp → Root RCE""" from kittysploit import from...

myDBR admin file editor save_file RCE

Challenge-response login default dba/dba then appsv/fileeditv.php savefile writes PHP under user/. !/usr/bin/env python3 -- coding: utf-8 -- """myDBR admin file editor savefile PHP webshell RCE.""" from future import annotations import hashlib import re from urllib.parse import quote, urlencode...

Apache Struts 2 RestfulActionMapper OGNL RCE

Apache Struts 2.6.11.x with struts.mapper.class=restful and wildcard 1 result dispatch: OGNL in the action name reaches Runtime.exec via java.beans.Statement / Expression sandbox bypass. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2 RestfulActionMapper OGNL injection unauthenticate...

Veeam ONE Reporter CommandExecutor authenticated RCE

PowerUser+ OAuth token; dashboard schedule reportSettings.command runs as VeeamSvc local Administrators. !/usr/bin/env python3 -- coding: utf-8 -- """Veeam ONE Reporter dashboard schedule CommandExecutor RCE.""" from future import annotations import json import time from kittysploit import from...

Microsip ASD version_firebird UNC binary planting RCE

Unauthenticated GET /versionfirebird?path= runs gbak.exe from attacker share as LocalSystem. !/usr/bin/env python3 -- coding: utf-8 -- """Microsip ASD unauthenticated versionfirebird UNC gbak binary planting RCE.""" from future import annotations from urllib.parse import quote from kittysploit...

Minuteman UPS system_param.csp unauth command injection

Unauthenticated POST /systemparam.csp with malicious WanIPAddr breaks out of ifconfig eth0 … netmask … system call. !/usr/bin/env python3 -- coding: utf-8 -- """Minuteman UPS NMC systemparam.csp WanIPAddr command injection.""" from future import annotations import re from urllib.parse import...

DataSunrise Suite Email Verification Code Brute Force RCE — Detect

Fingerprint / reachability check for DataSunrise Suite Email Verification Code Brute Force RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for DataSunrise Suite Email Verification Code Brute Force RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AdRem NetCrunch startup script RCE

RPC LoginEx then INcStartupScript SetScriptOptions + RestartNCServer. Use adminpassword or ncclipath on the NetCrunch server to obtain credentials. """AdRem NetCrunch Startup Script RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Codoforum admin category-image polyglot upload RCE

Authenticated admin upload of GIF/PHP polyglot to sites/default/assets/img/cats/; GET ?c= runs shellexec. """Codoforum admin category-image polyglot upload RCE.""" from future import annotations import re import time from urllib.parse import quote, urlencode from kittysploit import from...

Acumatica customization publish webshell RCE

Customizer-role user imports a ZIP via CustomizationApi/import, publishBegin/End, writes Pages/.aspx to IIS webroot; invoke with ?c= set payload for cmd.exe. """Acumatica authenticated customization import/publish → ASPX webshell RCE.""" from future import annotations import base64 import io impo...

CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Sett — Detect

Fingerprint / reachability check for CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Settings Root Directory Field CWE-93 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Settings Roo...

MultiTech Conduit AEP — Authenticated Command Injection in `import_config` → Roo — Detect

Fingerprint / reachability check for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE""" from kittysploit import from...

HiveMQ Data Hub Zip-Slip custom module cron root RCE

Admin POST /api/v1/cc-data-hub/module-instances/custom with Zip-Slip archive writing /etc/cron.d/. !/usr/bin/env python3 -- coding: utf-8 -- """HiveMQ Platform Data Hub custom module Zip-Slip cron root RCE.""" from future import annotations import base64 import io import json import random import...

atvise SCADA WebMI Default-Credential Authenticated Root RCE — Detect

Fingerprint / reachability check for atvise SCADA WebMI Default-Credential Authenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for atvise SCADA WebMI Default-Credential Authenticated Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

CatDV empty admin password aaftoolPath RCE

Login as admin with factory empty password, override aaftoolPath, trigger AAF export optional sshkey to stage /tmp/evil.sh. """CatDV factory-default empty admin password → aaftoolPath root RCE.""" from future import annotations import base64 import json import os import re import subprocess from...

IceWarp static route UNC external filter DLL RCE

Admin IQ RPC createaccount static route with rexternalfilterfile UNC; SMTP delivery triggers LoadLibrary. """IceWarp static route external filter UNC DLL load RCE.""" from future import annotations import re import socket import time from kittysploit import from lib.protocols.http.httpclient impo...