CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Sett — Detect

Fingerprint / reachability check for CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Settings Root Directory Field CWE-93 !/usr/bin/env python3 -- coding: utf-8 -- """Detection for CloudPanel 2.5.4-3 - nginx Virtual-Host Configuration Injection in the Site-Settings Roo...

Cambium cnMatrix SSL CSR command injection root RCE

Authenticated admin session; COMMONNAME field injected as ";CMD;echo " executed during CSR generation. """Cambium cnMatrix SSL CSR COMMONNAME command injection root RCE.""" from future import annotations import re from urllib.parse import urlencode, unquote from kittysploit import from...

Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE — Detect

Fingerprint / reachability check for Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for Lantronix EDS3000PR — Authenticated Command Injection in FsUnmount → Root RCE""" from kittysploit import from...

Docmosis Tornado storeTo file write cron RCE

Anonymous POST /api/render with storeTo=file:/etc/cron.d/... writes a cron line as root when the service runs with elevated privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Docmosis Tornado unauthenticated storeTo=file arbitrary write → cron root RCE.""" from future import annotations...

AdRem NetCrunch startup script RCE

RPC LoginEx then INcStartupScript SetScriptOptions + RestartNCServer. Use adminpassword or ncclipath on the NetCrunch server to obtain credentials. """AdRem NetCrunch Startup Script RCE""" from future import annotations from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Codoforum admin category-image polyglot upload RCE

Authenticated admin upload of GIF/PHP polyglot to sites/default/assets/img/cats/; GET ?c= runs shellexec. """Codoforum admin category-image polyglot upload RCE.""" from future import annotations import re import time from urllib.parse import quote, urlencode from kittysploit import from...

Acumatica customization publish webshell RCE

Customizer-role user imports a ZIP via CustomizationApi/import, publishBegin/End, writes Pages/.aspx to IIS webroot; invoke with ?c= set payload for cmd.exe. """Acumatica authenticated customization import/publish → ASPX webshell RCE.""" from future import annotations import base64 import io impo...

MultiTech Conduit AEP — Authenticated Command Injection in `import_config` → Roo — Detect

Fingerprint / reachability check for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for MultiTech Conduit AEP — Authenticated Command Injection in importconfig → Root RCE""" from kittysploit import from...

HiveMQ Data Hub Zip-Slip custom module cron root RCE

Admin POST /api/v1/cc-data-hub/module-instances/custom with Zip-Slip archive writing /etc/cron.d/. !/usr/bin/env python3 -- coding: utf-8 -- """HiveMQ Platform Data Hub custom module Zip-Slip cron root RCE.""" from future import annotations import base64 import io import json import random import...

atvise SCADA WebMI Default-Credential Authenticated Root RCE — Detect

Fingerprint / reachability check for atvise SCADA WebMI Default-Credential Authenticated Root RCE !/usr/bin/env python3 -- coding: utf-8 -- """Detection for atvise SCADA WebMI Default-Credential Authenticated Root RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

CatDV empty admin password aaftoolPath RCE

Login as admin with factory empty password, override aaftoolPath, trigger AAF export optional sshkey to stage /tmp/evil.sh. """CatDV factory-default empty admin password → aaftoolPath root RCE.""" from future import annotations import base64 import json import os import re import subprocess from...

Open eClass RCE (CVE-2024-26503) Detection

Detects GUnet Open eClass 3.15 instances potentially vulnerable to CVE-2024-26503 unrestricted badge icon upload leading to RCE. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from bs4 import BeautifulSoup import re class...

Linux Kernel LPE Router (CVE-2026)

From a low-privilege Linux shell, scores public 2026 kernel LPE modules Copy Fail, badepoll, nftables catch-all, ptrace, PackageKit, etc. and optionally runs the highest-priority eligible module on this session. !/usr/bin/env python3 -- coding: utf-8 -- """Probe Linux kernel LPE candidates 2026 a...

LiteLLM proxy_admin Privesc (CVE-2026-47101)

Post-exploitation variant of CVE-2026-47101: escalates an internaluser API key to proxyadmin via /key/generate wildcard routes and /user/update. Reads host, port, TLS, and keys from the active HTTP session when present. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM CVE-2026-47101 — post...

CVE-2026-26128 SMB Relay Privesc (from shell)

Post-exploitation wrapper for CVE-2026-26128: reads domain identity from an active Windows shell session, then launches the ADIDNS Unicode hostname + Kerberos coercion + SMB relay chain. Operator must still supply password, listener IP, and relay target AD CS or MSSQL. !/usr/bin/env python3 --...

Open eClass 3.15 - Remote Code Execution (CVE-2024-26503)

CVE-2024-26503: authenticated unrestricted file upload in /modules/admin/certbadge.php stores a PHP webshell under /courses/userprogressdata/badgetemplates/. !/usr/bin/env python3 -- coding: utf-8 -- """Open eClass CVE-2024-26503 authenticated certbadge icon upload RCE.""" from future import...

crawl4ai CVE-2026-91940 arbitrary file write

CVE-2026-91940 crawl4ai 0.9.3: POST /crawl with PDFContentScrapingStrategy and attacker-controlled imagesavedir writes extracted image streams to disk. Hosts a minimal PDF on lhost:lport and triggers /crawl. Patched versions return HTTP 400 not permitted. Requires API token on 0.9.2. !/usr/bin/en...

pdfminer.six CVE-2025-64512 polyglot RCE

CVE-2025-64512: malicious gzip+PDF polyglot deserializes pickle when a service runs pdf2txt/pdfminer on attacker-uploaded files. !/usr/bin/env python3 -- coding: utf-8 -- """pdfminer.six CVE-2025-64512 pickle polyglot PDF gzip RCE.""" from future import annotations import gzip import pickle from...

ntdll Unhooking Loader Evasion

Restore ntdll.dll .text from disk to strip userland hooks, then decrypt and run embedded shellcode via VirtualAlloc/CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

No Sleep

Prevent the hooked tab from sleeping Wake Lock API + silent video fallback, BeEF nosleep from kittysploit import class ModuleBrowserAuxiliary: info = "name": "No Sleep", "description": "Prevent the hooked tab from sleeping Wake Lock API + silent video fallback, BeEF nosleep", "author": "KittySplo...

AWS Loom CVE-2026-103956 unauthenticated super-admin

CVE-2026-103956 Loom for AWS 1.6.1: when Cognito / external IdP is unset, getcurrentuser grants t-admin / g-admins-super without Authorization. Confirms via GET /api/auth/me and optional read-only MCP server listing. !/usr/bin/env python3 -- coding: utf-8 -- """AWS Loom for AWS unauthenticated...

Magento CVE-2015-1397 Shoplift admin SQLi

CVE-2015-1397 Magento CE = 1.9.0.1: stacked SQLi via CmsWysiwyg/directive/index creates a full admin user without SUPEE-5344. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift unauthenticated admin SQLi.""" from future import annotations import base64 import re from...

WordPress WPMobile.App CVE-2026-94541 push category injection

CVE-2026-94541 WPMobile.App = 11.82: unauthenticated POST to /?wpapppushconfig=1 with HTTPXWPAPPNINJAID binds wpappcategory to arbitrary values including admin email without capability checks. When mail-to-push is enabled, mirrored wpmail notifications may be delivered to that device. This module...

WordPress Unlimited Elements blind SQLi (CVE-2026-103355)

CVE-2026-103355: Unlimited Elements for Elementor = 2.0.20 concatenates terms-listing parent IDs into WPTermQuery. When two pages exist whose widget stores boolean tautology vs falsity payloads, comparing rendered term output confirms blind SQL injection. Provide oracletruepath and oraclefalsepat...

Binwalk CVE-2022-4510 Detect

Detects Binwalk web admin console authenticated plugin RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Binwalk web admin console authenticated plugin RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Bludit CVE-2019-16113 Detect

Detects Bludit admin login authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Bludit admin login authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Bludit CVE-2019-161...

CMS Made Simple CVE-2019-9053 SQLi Detect

Time-based blind SQLi on moduleinterface.php News m1idlist. !/usr/bin/env python3 -- coding: utf-8 -- """CMS Made Simple CVE-2019-9053 time-based SQLi detection.""" from future import annotations import time from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

ISPConfig CVE-2023-46818 Detect

Detects ISPConfig panel login. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ISPConfig panel login.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "ISPConfig CVE-2023-46818 Detect", "description": "Detects...

motionEye CVE-2025-60787 Detect

Fingerprints motionEye web UI config API requires signingkey for exploit. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints motionEye web UI config API requires signingkey for exploit.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PDF.js CVE-2024-4367 Detect

Detects PDF.js viewer bundles on web apps. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PDF.js viewer bundles on web apps.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "PDF.js CVE-2024-4367 Detect",...

SQLPad CVE-2022-0944 Detect

Detects SQLPad web console. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SQLPad web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SQLPad CVE-2022-0944 Detect", "description": "Detects SQLPad web...

Erlang OTP SSH CVE-2025-32433 Detect

Detects SSH banner Erlang OTP SSH pre-auth RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SSH banner Erlang OTP SSH pre-auth RCE chain.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient:...

UnrealIRCd CVE-2010-2075 Detect

Detects UnrealIRCd banner on IRC port. !/usr/bin/env python3 -- coding: utf-8 -- """Detects UnrealIRCd banner on IRC port.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = "name": "UnrealIRCd...

GitPython CVE-2022-24439 ext URL RCE

CVE-2022-24439 GitPython = 3.1.29: malicious ext::sh clone URL runs shell commands when an HTTP app passes user input to clonefrom with protocol.ext.allow=always. !/usr/bin/env python3 -- coding: utf-8 -- """GitPython CVE-2022-24439 ext:: transport RCE via clone URL injection.""" from future impo...

Grafana CVE-2024-9264 SQL Expressions RCE

CVE-2024-9264 Grafana 11.0.0–11.2.0: Viewer+ can run SQL Expressions with DuckDB readtext / shellfs for arbitrary file read and command execution when duckdb shellfs is available in PATH. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana CVE-2024-9264 SQL Expressions DuckDB authenticated RCE /...

Classic Remote Shellcode Injection

Build an injector EXE that decrypts shellcode and injects it into a remote process via VirtualAllocEx/WriteProcessMemory/CreateRemoteThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

Sandbox Evasion Loader

Apply sandbox heuristics RAM/CPU/disk, mouse movement, sleep timing and only execute decrypted shellcode when the environment looks benign. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from...

Get Session Storage

Extract all data from sessionStorage on the hooked origin BeEF getsessionstorage from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Get Session Storage", "description": "Extract all data from sessionStorage on the hooked origin BeEF getsessionstorage", "author":...

Man In The Browser

Rewrite same-origin links and form actions to a chosen URL BeEF linkrewrite / MITB from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Man In The Browser", "description": "Rewrite same-origin links and form actions to a chosen URL BeEF linkrewrite / MITB", "author":...

Keycloak CVE-2026-18963 reset-credentials bypass

CVE-2026-18963 Keycloak 26.0.0–26.7.1: re-navigation to reset-credentials re-opens the authentication selector and reset-credential-email accepts success without the emailed action token. Default: detect-only; set confirm=true to overwrite the target user's password destructive ATO. !/usr/bin/env...

Metabase CVE-2026-72898 reset_password SQLi

CVE-2026-72898: unauthenticated POST /api/session/resetpassword accepts user-id :raw SQL for stacked queries on PostgreSQL app DB — creates superuser and opens Metabase HTTP session. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword HoneySQL injection admin...

WordPress Kirki CVE-2026-8206 password-reset takeover

CVE-2026-8206: Kirki 6.0.0–6.0.6 CompLibFormHandler accepts an arbitrary email when resetting by username. POSTs to /wp-json/KirkiComponentLibrary/v1/kirki-forgot-password with X-WP-Element-Nonce, redirecting the victim's reset link to attackeremail. Does not complete the password change requires...

ZoneMinder CVE-2024-51482 removetag SQLi

CVE-2024-51482 ZoneMinder = 1.37.64: boolean SQLi in ajax/event.php removetag tid parameter HTTP 200=true, 500=false. Extracts credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder CVE-2024-51482 authenticated boolean-blind SQLi.""" from future import annotations import re from...

GitPython CVE-2022-24439 Detect

Heuristic for apps exposing git clone URLs GitPython RCE when user controls remote. !/usr/bin/env python3 -- coding: utf-8 -- """Heuristic for apps exposing git clone URLs GitPython RCE when user controls remote.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

ImageMagick CVE-2022-44268 Detect

Detects ImageMagick/GraphicsMagick conversion endpoints filename read primitive. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ImageMagick/GraphicsMagick conversion endpoints filename read primitive.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Joomla Simple Membership CVE-2026-102782 Detect

Detects OrdaSoft comsimplemembership 7.4.0 and reachable checkLoginPass task. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla Simple Membership CVE-2026-102782.""" import re from urllib.parse import urlencode from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Nezha CVE-2026-53519 Detect

Fingerprints Nezha monitoring dashboard/API. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints Nezha monitoring dashboard/API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Nezha CVE-2026-53519 Detect",...

OpenNetAdmin CVE-2019-25065 Detect

Detects OpenNetAdmin installation. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenNetAdmin installation.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "OpenNetAdmin CVE-2019-25065 Detect", "description":...

PDFMiner CVE-2025-64512 Detect

Heuristic for PDF upload/parse endpoints pdfminer.six CMap RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Heuristic for PDF upload/parse endpoints pdfminer.six CMap RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

pyLoad CVE-2023-0297 Detect

Fingerprints pyLoad UI and /flash/addcrypted2 endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad CVE-2023-0297 /flash/addcrypted2 js2py surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "pyLoad...