LiteLLM CVE-2026-59822 MCP Auth Bypass Detect

Detects CVE-2026-59822 in LiteLLM proxy before 1.84.0: failed LiteLLM key validation on the MCP Streamable HTTP endpoint falls back to an empty UserAPIKeyAuth object when a fabricated Authorization Bearer is supplied. !/usr/bin/env python3 -- coding: utf-8 -- """Detect LiteLLM CVE-2026-59822 MCP...

Magento CVE-2026-71362 Customer Account Takeover

Exploits CVE-2026-71362 APSB26-92: a failed customer account editPost leaves attacker-controlled customerformdata in session, and a later edit consumes mass-assigned id to rebind the session to another customer. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CVE-2026-71362 customer session...

Telemetry Buffer (PowerShell)

Persist bootstrap errors locally and flush them after the first C2 poll !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.telemetrycontext import resolvetelemetrycontext class ModulePrestage: PRESTAGEID =...

Signed Config (Zig)

Embed encrypted and signed operator config separate from the payload body !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.signedconfigcontext import resolvesignedconfigcontext class ModulePrestage: PRESTAGEID =...

Stage Cache (PowerShell)

Verified local stage cache with TTL expiration and interrupted download resume !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import from core.payloadgeneration.prestage.stagecachecontext import resolvestagecachecontext class ModulePrestage: PRESTAGEID =...

Zyxel GS1900 CVE-2026-7273 Detect

Detects Zyxel GS1900 smart-managed switches running firmware 2.90XXXX.1C0 or earlier, vulnerable to CVE-2026-7273 stack-based buffer overflow in the web-management CGI program. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Zyxel GS1900 CVE-2026-7273 CGI stack buffer overflow exposure."""...

SonicWall SMA1000 CVE-2026-83548 SSRF Detect

Detects CVE-2026-83548 in SonicWall SMA1000 WorkPlace before hotfixes 12.4.3-03526 / 12.5.0-02952. Sends an unauthenticated absolute-form OPTIONS request that WorkPlace forwards to loopback CouchDB; a 405 methodnotallowed JSON body confirms the SSRF primitive. !/usr/bin/env python3 -- coding: utf...

Citrix NetScaler CVE-2026-88773 Detect

Detects Citrix NetScaler ADC/Gateway builds likely affected by CVE-2026-88773 HTTP request/response smuggling, CWE-444. Confirms NetScaler presence and parses appliance firmware against CTX697096 fixed builds 14.1-73.37+, 13.1-64.23+. Does not send smuggling probes. !/usr/bin/env python3 -- codin...

Citrix NetScaler CVE-2026-88771 Detect

Detects Citrix NetScaler ADC/Gateway instances likely affected by CVE-2026-88771. Confirms NetScaler presence, parses appliance build when exposed, and checks whether the AAA login path accepts the pitboss/PPE log trigger pattern used by nsmonuploadderr.pl. !/usr/bin/env python3 -- coding: utf-8 ...

Metabase - H2 Deserialization RCE (CVE-2026-59827)

Exploits CVE-2026-59827 by authenticating to Metabase, locating an H2 database including the default sample DB, and submitting a native query that deserializes a Clojure PriorityQueue gadget chain via SELECT CASTX'...' AS OTHER. Command execution is blind — output is not returned over HTTP...

FreePBX - Unauth SQLi Detection (CVE-2025-57819)

Detects CVE-2025-57819 via error-based SQL injection on /admin/ajax.php brand parameter, Endpoint Manager module. Confirms MySQL XPATH error leaking freepbxuser. Full RCE requires stacked-query cronjobs injection. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX Endpoint Manager unauth SQLi...

Metabase - H2 Deserialization RCE Detection (CVE-2026-59827)

Detects potentially vulnerable Metabase versions affected by CVE-2026-59827 unsafe Java deserialization of H2 OTHER columns in native queries. Confirms version via /api/session/properties; full exploitation requires authenticated native-query access to an H2 database. !/usr/bin/env python3 --...

Apache NiFi ExecuteProcess RCE

Abuses an unauthenticated or credentialed Apache NiFi REST API to create an ExecuteProcess processor in the root process group, run an OS command, then stop and delete the processor. Requires ExecuteProcess to be available on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi...

SAP NetWeaver ConfigServlet RCE

Exploits unauthenticated command execution via EXECUTECMD on /ctc/servlet/ConfigServlet/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver ConfigServlet EXECUTECMD RCE — execute session.""" from future import annotations import re from urllib.parse...

Webp Server Go - Path Traversal File Read

Reads arbitrary files via path traversal in Webp Server Go github.com/webp-sh/webpservergo. !/usr/bin/env python3 -- coding: utf-8 -- """Webp Server Go path traversal file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi...

Zabbix locales.php RCE

Exploits unauthenticated PHP code injection in Zabbix = 1.6.2 via the extlang parameter on locales.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix locales.php RCE = 1.6.2 — execute session.""" from future import annotations import re from urllib.pars...

Sangfor Application - download.php File Read

Reads arbitrary files via Sangfor Application /report/download.php?pdf= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Application download.php pdf parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Samsung WLAN AP WEA453e - Pre-Auth RCE

Exploits pre-authentication command execution on Samsung WLAN AP WEA453e via command1=shell: on /download/, then reads output through the download handler. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e pre-auth RCE — execute session."""...

Apache Hadoop YARN - Unauthenticated RCE

Exploits unauthenticated YARN ResourceManager REST API to submit a malicious application whose AM container runs self.payload on a cluster worker node. Blind execution — use a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Hadoop YARN ResourceManager unauthenticated RCE ...

ALCASAR Host Header RCE

Exploits ALCASAR command injection via a crafted Host header on /alcasar/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ALCASAR Host header command injection RCE — execute session.""" from future import annotations import re from kittysploit import...

EditWrxLite - wrx.cgi RCE

Exploits EditWrxLite command injection via the download parameter of wrx.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """EditWrxLite wrx.cgi command injection RCE — execute session.""" from future import annotations import re from urllib.parse import quote...

WedgeOS - ssgimages File Read

Reads arbitrary files via WedgeOS = 4.0.4 /ssgmanager/ssgimages?name= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """WedgeOS ssgimages name parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi class...

Sangfor EDR - slog_client RCE

Exploits unauthenticated command injection in Sangfor EDR 3.2.17R1/3.2.21 via /api/edr/sangforinter/v2/cssp/slogclient JSON params. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor EDR 3.2.17R1/3.2.21 slogclient RCE — execute session.""" from future impor...

DedeCMS flink.php RCE

Exploits DedeCMS 5.8.1-beta variable override via Referer header injection on /plus/flink.php with the c query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS 5.8.1-beta flink.php variable override RCE — execute session.""" from future import...

Basilic diff.php RCE

Exploits command injection in Basilic = 1.5.14 via the file parameter on /Config/diff.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection RCE — execute session.""" from future import annotations import re from...

EverFocus - Path Traversal File Read

Reads arbitrary files via EverFocus directory traversal using /../../../../../../ style paths. !/usr/bin/env python3 -- coding: utf-8 -- """EverFocus DVR/camera directory traversal file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.l...

Cuppa CMS - alertConfigField.php File Read

Reads arbitrary files via Cuppa CMS alerts/alertConfigField.php urlConfig traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Cuppa CMS alertConfigField.php urlConfig file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import...

jQuery File Upload RCE (CVE-2018-9206)

Exploits CVE-2018-9206 by uploading a PHP shell to blueimp jQuery-File-Upload endpoints and executing commands via GET. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """blueimp jQuery File Upload unauth PHP upload RCE CVE-2018-9206 — execute session.""" from futu...

HybridAuth - install.php RCE (CVE-2014-125116)

Exploits CVE-2014-125116 by writing system$POST0 into config.php via the HybridAuth installer, then invoking commands through config.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """HybridAuth install.php / config.php RCE CVE-2014-125116 — execute session.""...

Horde javascript.php Backdoor RCE (CVE-2012-0209)

Exploits CVE-2012-0209 by passing shell commands through the href Cookie to /services/javascript.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Horde javascript.php backdoor RCE CVE-2012-0209 — execute session.""" from future import annotations import re...

Fortra GoAnywhere MFT Auth Bypass RCE (CVE-2024-0204)

Exploits CVE-2024-0204 to create an administrator via the InitialAccountSetup wizard path traversal, upload a JSP payload through the FileManager, and execute a reverse CMD command. GoAnywhere MFT 6.0.1 through 7.4.0. !/usr/bin/env python3 -- coding: utf-8 -- """Fortra GoAnywhere MFT auth bypass ...

Gitlist blame RCE (CVE-2014-4511)

Exploits CVE-2014-4511 command injection in Gitlist blame paths via backtick-wrapped shell metacharacters. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Gitlist blame path command injection RCE CVE-2014-4511 — execute session.""" from future import annotations...

GeoServer Unauthenticated RCE (CVE-2024-36401)

Exploits CVE-2024-36401 XPath injection in GeoServer WFS GetPropertyValue. Affected: 2.23.6, 2.24.0–2.24.3, 2.25.0–2.25.1. Blind RCE confirmed by HTTP 400 + ClassCastException. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer unauthenticated XPath injection RCE CVE-2024-36401 — reverse CMD...

ESVA - learn-msg.cgi RCE (CVE-2012-10046)

Exploits CVE-2012-10046 by injecting OS commands into the id parameter of /cgi-bin/learn-msg.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046 — execute session.""" from future import annotations import re...

Atlassian Confluence SSTI RCE (CVE-2023-22527)

Exploits CVE-2023-22527 OGNL injection on /template/aui/text-inline.vm to run arbitrary OS commands via freemarker Execute.exec. Confluence 8.0.0–8.5.3 are affected. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence SSTI / OGNL RCE CVE-2023-22527 — reverse CMD session.""" from...

Apache OFBiz Auth Bypass Groovy RCE (CVE-2023-51467)

Exploits CVE-2023-51467 authentication bypass empty credentials + requirePasswordChange=Y to reach /webtools/control/ProgramExport and run arbitrary Groovy via groovyProgram. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz auth bypass + Groovy RCE...

GeoServer CVE-2024-36401 Detection

Detects CVE-2024-36401 by checking vulnerable version ranges and confirming XPath injection on WFS GetPropertyValue HTTP 400 + ClassCastException. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer CVE-2024-36401 WFS XPath injection detection.""" import re import xml.etree.ElementTree as ET...

Apache Commons Text CVE-2022-42889 Detection

Detects CVE-2022-42889 Text4Shell via a blind sleep injection using the script:javascript StringSubstitutor lookup on a target parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text CVE-2022-42889 Text4Shell detection.""" import random import time from kittysploit import from...

Apache Solr CVE-2019-0193 Velocity RCE Detection

Detects CVE-2019-0193 by running a marker echo through the Velocity response writer on /core/select wt=velocity. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2019-0193 Velocity template RCE detection.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Webmin password_change.cgi RCE (CVE-2019-15107)

Exploits CVE-2019-15107 unauthenticated command injection in the passwordchange.cgi "old" parameter Webmin = 1.920. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin passwordchange.cgi RCE CVE-2019-15107 — execute session.""" from future import annotations...

TWiki debugenableplugins RCE (CVE-2014-7236)

Exploits CVE-2014-7236 Perl injection via debugenableplugins on /view/Main/WebHome. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """TWiki debugenableplugins Perl RCE CVE-2014-7236 — execute session.""" from future import annotations import re from urllib.parse...

Apache Solr Backup/Restore RCE (CVE-2023-50386)

Exploits CVE-2023-50386 by uploading a malicious ConfigSet containing SourceParser.class, creating a collection, using BACKUP APIs to place the class on Solr's classpath, then loading it via a second ConfigSet. Requires SolrCloud ZooKeeper. Solr 6.0.0–8.11.2 and 9.0.0–9.4.0. !/usr/bin/env python3...

Apache NiFi H2 JDBC RCE (CVE-2023-34468)

Exploits CVE-2023-34468 by creating a DBCPConnectionPool controller service with a malicious H2 JDBC URL INIT=RUNSCRIPT FROM attacker, enabling it, and triggering ExecuteSQL. Affected NiFi 0.0.2 through 1.21.0. Requires permission to create controller services often unauthenticated. !/usr/bin/env...

Apache Druid JavaScript RCE (CVE-2021-25646)

Exploits CVE-2021-25646 by enabling the JavaScript parser through /druid/indexer/v1/sampler and running arbitrary OS commands. Druid 0.20.1; authentication is off by default. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Druid JavaScript sampler RCE...

VICIdial manager_send.php RCE (CVE-2013-4468)

Exploits CVE-2013-4468 command injection via the extension parameter on /agc/managersend.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """VICIdial managersend.php command injection RCE CVE-2013-4468 — execute session.""" from future import annotations import...

Synology DSM - imageSelector.cgi RCE (CVE-2013-6955)

Exploits CVE-2013-6955 by appending shell commands into redirect.cgi via imageSelector.cgi SLICEUPLOAD, then reading output from /redirect.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Synology DSM imageSelector.cgi RCE CVE-2013-6955 — execute session."""...

AlienVault OSSIM av-centerd RCE (CVE-2014-3804)

Exploits CVE-2014-3804 command injection in the av-centerd updatesysteminfodebianpackage SOAP method. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804 — execute session.""" from future import annotations import r...

vBSEO proc_deutf RCE (CVE-2012-5223)

Exploits CVE-2012-5223 eval injection in vBSEO via charrepl POST to vbseocp.php with base64 PHP in the Code header. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """vBSEO procdeutf eval RCE CVE-2012-5223 — execute session.""" from future import annotations import...

Apache Commons Text RCE (CVE-2022-42889 / Text4Shell)

Exploits CVE-2022-42889 in Apache Commons Text 1.5–1.9 when the StringSubstitutor default interpolator evaluates $script:javascript:... lookups. Requires a vulnerable request parameter on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text StringSubstitutor RCE...

Apache Archiva OGNL RCE (CVE-2013-2251)

Exploits CVE-2013-2251 OGNL injection via redirect: on /security/login.action. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Archiva Struts OGNL RCE CVE-2013-2251 — execute session.""" from future import annotations import re from urllib.parse import...