Drupal RESTWS passthru RCE

Exploits Drupal RESTWS module RCE via taxonomyvocabulary passthru callbacks SA-CONTRIB-2016-040. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal RESTWS taxonomyvocabulary passthru RCE — execute session.""" from future import annotations import re from...

Atlassian Confluence Setup Bypass RCE (CVE-2023-22515)

Exploits CVE-2023-22515 to reset setupComplete, create an administrator account, upload a malicious Confluence plugin servlet, and execute a reverse CMD payload. Affects Confluence 8.0.0–8.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence setup reset + admin creation + plugin...

Sangfor EDR - slog_client RCE

Exploits unauthenticated command injection in Sangfor EDR 3.2.17R1/3.2.21 via /api/edr/sangforinter/v2/cssp/slogclient JSON params. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor EDR 3.2.17R1/3.2.21 slogclient RCE — execute session.""" from future impor...

Apache Commons Text CVE-2022-42889 Detection

Detects CVE-2022-42889 Text4Shell via a blind sleep injection using the script:javascript StringSubstitutor lookup on a target parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text CVE-2022-42889 Text4Shell detection.""" import random import time from kittysploit import from...

Apache Commons Text RCE (CVE-2022-42889 / Text4Shell)

Exploits CVE-2022-42889 in Apache Commons Text 1.5–1.9 when the StringSubstitutor default interpolator evaluates $script:javascript:... lookups. Requires a vulnerable request parameter on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Commons Text StringSubstitutor RCE...

Bash Shellshock HTTP CGI RCE (CVE-2014-6271)

Exploits CVE-2014-6271 by injecting :;; into HTTP headers against CGI-enabled paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Bash Shellshock HTTP CGI RCE CVE-2014-6271 — execute session.""" from future import annotations import re from kittysploit import...

Dahua ICC - GetClassValue.jsp RCE

Exploits unauthenticated remote code execution in Dahua Intelligent IoT Integrated Management Platform via RuntimeUtil.syncexecReturnInputStream on GetClassValue.jsp. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Dahua ICC GetClassValue.jsp RCE — execute...

AirLive cgi_test.cgi RCE (CVE-2015-2279)

Exploits CVE-2015-2279 OS command injection in /cgitest.cgi via the writetan parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AirLive cgitest.cgi command injection RCE CVE-2015-2279 — execute session.""" from future import annotations import re from...

Apache Solr Velocity Template RCE (CVE-2019-0193)

Exploits CVE-2019-0193 Velocity template injection on /core/select when the VelocityResponseWriter is enabled. Runs OS commands via wt=velocity and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr Velocity template RCE CVE-2019-0193 — execute...

ManageEngine SDP - FileDownload.jsp fName File Read

Reads arbitrary files via ManageEngine ServiceDesk Plus FileDownload.jsp fName path traversal with null-byte truncation. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine ServiceDesk Plus FileDownload.jsp fName file read.""" from urllib.parse import quote from kittysploit import from...

CrushFTP Unauthenticated RCE (CVE-2023-43177)

Exploits CVE-2023-43177 AS2 header injection to read sessions.obj, hijack or escalate to an administrator session, upload a malicious JDBC driver JAR, and execute a reverse CMD payload via testDB. CrushFTP versions prior to 10.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """CrushFTP...

Monitorix Pipe RCE (CVE-2013-7070)

Exploits CVE-2013-7070/7071 by injecting commands into pipe-wrapped Monitorix URL paths. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Monitorix pipe path command injection RCE CVE-2013-7070 — execute session.""" from future import annotations import re from...

Elastix - graph.php File Read

Reads arbitrary files via Elastix vtigercrm/graph.php currentlanguage LFI. !/usr/bin/env python3 -- coding: utf-8 -- """Elastix vtigercrm graph.php currentlanguage file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi import Lfi cla...

Apache NiFi H2 JDBC RCE Detection (CVE-2023-34468)

Detects Apache NiFi versions before 1.22.0 with API access to process groups. Such hosts may allow H2 JDBC URLs in DBCPConnectionPool CVE-2023-34468. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi H2 JDBC RCE surface detection CVE-2023-34468.""" from kittysploit import from...

D-Link DNS-320/325 - system_mgr.cgi SMS Test RCE

Exploits command injection in cgismstest via the command1 parameter on /cgi-bin/systemmgr.cgi distinct from CVE-2020-25506 NTP injection. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320/325 systemmgr.cgi SMS test RCE — execute session.""" from...

Sangfor NGAF - loadfile.php File Read

Reads arbitrary files via Sangfor Next Gen Application Firewall /svpnhtml/loadfile.php file parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor NGAF loadfile.php arbitrary file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

GeoVision GeoHttpServer - Path Traversal File Read

Reads arbitrary files via GeoVision GeoHttpServer = 8.3.3.0 path traversal using /.../.../ style segments. !/usr/bin/env python3 -- coding: utf-8 -- """GeoVision GeoHttpServer path traversal file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DIR - __show_info.php File Read (CVE-2017-12943)

Reads arbitrary files via REQUIREFILE on /model/showinfo.php CVE-2017-12943. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR showinfo.php file read CVE-2017-12943.""" from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Mundi Mail mypid Command Injection RCE

Exploits command injection in Mundi Mail via the mypid parameter on /admin/status/index.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Mundi Mail mypid command injection — execute session.""" from future import annotations import re from kittysploit import...

PineApp Mail-SeCure test_li_connection RCE

Exploits command injection in PineApp Mail-SeCure via the iptest parameter on /admin/testliconnection.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """PineApp Mail-SeCure testliconnection.php RCE — execute session.""" from future import annotations import re...

EditWrxLite - wrx.cgi RCE

Exploits EditWrxLite command injection via the download parameter of wrx.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """EditWrxLite wrx.cgi command injection RCE — execute session.""" from future import annotations import re from urllib.parse import quote...

SAP NetWeaver ConfigServlet RCE

Exploits unauthenticated command execution via EXECUTECMD on /ctc/servlet/ConfigServlet/. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver ConfigServlet EXECUTECMD RCE — execute session.""" from future import annotations import re from urllib.parse...

Sangfor Application - download.php File Read

Reads arbitrary files via Sangfor Application /report/download.php?pdf= traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor Application download.php pdf parameter file read.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.lfi...

Samsung WLAN AP WEA453e - Pre-Auth RCE

Exploits pre-authentication command execution on Samsung WLAN AP WEA453e via command1=shell: on /download/, then reads output through the download handler. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e pre-auth RCE — execute session."""...

DedeCMS flink.php RCE

Exploits DedeCMS 5.8.1-beta variable override via Referer header injection on /plus/flink.php with the c query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """DedeCMS 5.8.1-beta flink.php variable override RCE — execute session.""" from future import...

Basilic diff.php RCE

Exploits command injection in Basilic = 1.5.14 via the file parameter on /Config/diff.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Basilic Config/diff.php command injection RCE — execute session.""" from future import annotations import re from...

DotCMS Arbitrary File Upload RCE (CVE-2022-26352)

Exploits CVE-2022-26352 path traversal in multipart filenames on POST /api/content/ to write a JSP shell under webapps/ROOT, then triggers a reverse CMD payload. !/usr/bin/env python3 -- coding: utf-8 -- """DotCMS arbitrary file upload RCE CVE-2022-26352 — JSP upload + reverse CMD.""" from future...

Apache Spark doAs Command Injection RCE (CVE-2022-33891)

Exploits CVE-2022-33891 command injection in the Spark ACL check when spark.acls.enable is true. Sends a crafted doAs POST parameter to run arbitrary shell commands as the Spark process user. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Spark doAs command injection RCE CVE-2022-33891 —...

ConnectWise ScreenConnect Auth Bypass RCE (CVE-2024-1709)

Exploits CVE-2024-1709 to recreate the setup wizard and register an administrator, then CVE-2024-1708 path traversal in extension install to drop a .ashx handler that runs a reverse CMD payload. ScreenConnect = 23.9.7. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise ScreenConnect auth...

Apache Archiva OGNL RCE (CVE-2013-2251)

Exploits CVE-2013-2251 OGNL injection via redirect: on /security/login.action. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Archiva Struts OGNL RCE CVE-2013-2251 — execute session.""" from future import annotations import re from urllib.parse import...

Apache Solr CVE-2023-50386 Backup/Restore RCE Detection

Detects Apache Solr 6.0.0–8.11.2 / 9.0.0–9.4.0 in SolrCloud mode with reachable ConfigSets API CVE-2023-50386 attack surface. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2023-50386 detection backup/restore ConfigSet RCE surface.""" import re from kittysploit import from...

Apache Druid JavaScript RCE (CVE-2021-25646)

Exploits CVE-2021-25646 by enabling the JavaScript parser through /druid/indexer/v1/sampler and running arbitrary OS commands. Druid 0.20.1; authentication is off by default. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Druid JavaScript sampler RCE...

Piwik Loader.php Backdoor RCE

Exploits the historical Piwik Loader.php backdoor via the g=system query parameter. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Piwik/Matomo Loader.php backdoor RCE — execute session.""" from future import annotations import re from kittysploit import from...

AlienVault OSSIM av-centerd RCE (CVE-2014-3804)

Exploits CVE-2014-3804 command injection in the av-centerd updatesysteminfodebianpackage SOAP method. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """AlienVault OSSIM av-centerd SOAP RCE CVE-2014-3804 — execute session.""" from future import annotations import r...

ESVA - learn-msg.cgi RCE (CVE-2012-10046)

Exploits CVE-2012-10046 by injecting OS commands into the id parameter of /cgi-bin/learn-msg.cgi. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """ESVA learn-msg.cgi command injection CVE-2012-10046 — execute session.""" from future import annotations import re...

Apache OFBiz CVE-2023-51467 Auth Bypass Detection

Detects CVE-2023-51467 by accessing /webtools/control/ping with empty credentials and requirePasswordChange=Y, then confirming Groovy execution via ProgramExport. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz CVE-2023-51467 authentication bypass detection.""" import re from kittysploi...

OmniPCX - masterCGI RCE (CVE-2007-3010)

Exploits CVE-2007-3010 by injecting OS commands into the user parameter of /cgi-bin/masterCGI. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Alcatel-Lucent OmniPCX masterCGI RCE CVE-2007-3010 — execute session.""" from future import annotations import re from...

Grav CMS Blueprint dynamicData RCE (CVE-2026-65008)

Exploits CVE-2026-65008 in Grav CMS 2.0.7 fixed in 2.0.7: an authenticated user with admin.pages permission can plant a malicious forms frontmatter directive data-opts@ that routes through Blueprint::dynamicData to Grav\Common\Utils::arrayFilterRecursive and system. Execution triggers when any...

Ghost CMS Remote Code Execution (CVE-2026-29053)

Exploits CVE-2026-29053 in Ghost CMS 0.7.2–6.19.0: a malicious theme template abuses Handlebars get filter parsing to reach Node.js childprocess.exec. Requires Ghost Admin access password, API key, session cookie, session secret, or invite flow. Versions 5.105.0–5.130.5 and 6.0.0–6.10.3 also...

miniOrange SAML SSO Auth Bypass RCE (CVE-2026-15013)

Exploits CVE-2026-15013 in miniOrange SAML SSO = 5.4.3: HMAC signature algorithm confusion in SAML assertion validation lets an unauthenticated attacker forge a signed assertion using the IdP X509 public key as the HMAC secret. Enumerates WordPress users, obtains admin via forged SAMLResponse,...

Linksys E1200 v2 - tmUnblock.cgi Command Injection (CVE-2025-60689)

Unauthenticated OS command injection in Linksys E1200 firmware = v2.0.04 via POST /tmUnblock.cgi ttcpip. Blind injection: use the default reverse payload/listener or nopayload + execute session. Admin UI is often on port 80 or 8080 depending on deployment. !/usr/bin/env python3 -- coding: utf-8 -...

Asus B1M Projector RCE

Module exploits Asus B1M Projector Remote Code Execution vulnerability which allows executing command on operating system level with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Asus B1M Projector RCE""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Grandstream GXV3611 HD - Telnet Backdoor

Triggers the hidden Grandstream GXV3611 HD telnet backdoor !/ port lol which starts a root shell on TCP/20000, then opens a framework shell session. !/usr/bin/env python3 -- coding: utf-8 -- """Grandstream GXV3611 HD telnet backdoor trigger — opens framework shell session.""" import time from...

WePresent WiPG-1000 RCE

Module exploits WePresent WiPG-1000 Command Injection vulnerability which allows executing commands on operating system level. !/usr/bin/env python3 -- coding: utf-8 -- """WePresent WiPG-1000 RCE""" import struct from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DWR-932B - UDP Backdoor (HELODBG)

Sends the HELODBG UDP packet to enable the hidden telnet service on D-Link DWR-932B devices, then opens a framework shell session as root. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DWR-932B UDP HELODBG backdoor — opens framework shell session.""" from future import annotations import...

Daemonize / Hide Console (PowerShell)

Hide console window and lower process priority before callback !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize / Hide Console PowerShell", "description": "Hide console window an...

Daemonize Process (Python)

Detach from the controlling terminal on Unix double-fork !/usr/bin/env python3 -- coding: utf-8 -- from typing import Any, Dict from kittysploit import class ModulePrestage: PRESTAGEID = "daemonize" info = "name": "Daemonize Process Python", "description": "Detach from the controlling terminal on...

D-Link DNS-320L & DIR-327L RCE

Module exploits D-Link DNS-320L, DNS-327L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DNS-320L & DIR-327L RCE""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

D-Link DIR-815 & DIR-850L RCE

Module exploits D-Link DIR-815 and DIR-850L Remote Code Execution vulnerability which allows executing command on the device. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-815 & DIR-850L RCE""" import socket from kittysploit import from lib.exploit.handler import Handler class...

Huawei HG866 Password Change

Module exploits password change vulnerability in Huawei HG866 devices. If the target is vulnerable it allows to change administration password. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG866 Password Change""" import re from kittysploit import from lib.protocols.http.httpclient import...