ActiveMQ CVE-2023-46604 Detect

Detects open ActiveMQ OpenWire port ClassPathXmlApplicationContext chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects open ActiveMQ OpenWire port ClassPathXmlApplicationContext chain.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient...

Joomla Helix3 <= 3.1.1 - Unauthenticated Arbitrary File Write (CVE-2026-49049)

CVE-2026-49049 in JoomShaper Helix3 = 3.1.1: unauthenticated file write via comajax helix3 save path traversal in layoutName, arbitrary file delete via remove, and template parameter overwrite via import Helix3 v3.x. The save action always appends .json — no reliable shell; use for authorized fil...

Phproject CVE-2026-104991 detect

Detects self-hosted Phproject = 1.8.6 REST issue API used in CVE-2026-104991 missing allowAccess on read/comment endpoints when security.restrictaccess is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Phproject issue tracker CVE-2026-104991 REST BOLA context.""" import re from...

Adminer CVE-2020-35572 arbitrary file read

CVE-2020-35572 Adminer = 4.6.2: server driver makes Adminer connect outbound to attacker MySQL; LOAD DATA LOCAL INFILE pulls target files. !/usr/bin/env python3 -- coding: utf-8 -- """Adminer CVE-2020-35572 rogue-MySQL LOAD DATA LOCAL file read.""" from future import annotations import re from...

CMS Made Simple CVE-2019-9053 time-based SQLi

CVE-2019-9053 CMSMS = 2.2.9: unauthenticated time-based blind SQLi in moduleinterface.php News m1idlist extracts admin hash. !/usr/bin/env python3 -- coding: utf-8 -- """CMS Made Simple CVE-2019-9053 unauthenticated time-based SQLi.""" from future import annotations import hashlib import time fro...

Magento CVE-2015-1398 tunnel unserialize RCE

CVE-2015-1398 Magento CE = 1.9.0.1: admin dashboard tunnel unserializes ?ga= POP chain to system; blind — read output file or use sleep oracle. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1398 authenticated POP chain tunnel RCE blind.""" from future import annotations import...

LiteLLM CVE-2026-47101 proxy_admin privesc

CVE-2026-47101: an internaluser API key can call /key/generate with wildcard allowedroutes, then /user/update to escalate to proxyadmin. Supply masterkey to bootstrap an internal user, or an existing userkey. !/usr/bin/env python3 -- coding: utf-8 -- """LiteLLM CVE-2026-47101 internaluser to...

WordPress 3D FlipBook CVE-2025-58226 sensitive data dump

CVE-2025-58226 ≤ 1.16.16: unauthenticated admin-ajax actions fb3dsendposts and fb3dsendpost expose all flipbook posts including password-protected, metadata, and backing PDF/media URLs. Read-only information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2025-58226 — 3D FlipBook...

Citrix NetScaler CVE-2026-88772 DTLS Overflow Trigger

Sends the malformed DTLS handshake fragment sequence from public CVE-2026-88772 research leviathan-offsec/lvx-vuln-research: each fragment declares fragmentlength=1 while carrying a larger payload, driving NSPPE reassembly accounting into a fixed scratch buffer overflow. This is a vulnerability...

Joomla SP Page Builder CVE-2026-48908 upload RCE

CVE-2026-48908 SP Page Builder ≤ 6.6.1: unauthenticated asset.uploadCustomIcon accepts a ZIP into web-served iconfont paths, allowing PHP webshell upload and execution. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla SP Page Builder CVE-2026-48908 unauthenticated ZIP upload RCE.""" import io...

Erlang OTP SSH CVE-2025-32433 pre-auth RCE

CVE-2025-32433: vulnerable Erlang/OTP SSH servers accept SSHMSGCHANNELREQUEST exec before authentication completes. Sends a file:writefile/2 Erlang snippet default writes /tmp/erlangpwned. !/usr/bin/env python3 -- coding: utf-8 -- """Erlang/OTP SSH CVE-2025-32433 pre-auth SSH channel exec...

Ahsay CBS CVE-2026-105134 UpdateReceivers command injection

CVE-2026-105134: Ahsay AhsayCBS Replication Receiver POST /rps/api/json/UpdateReceivers.do passes the JSON random field into a shell command without sanitization. Supports confirm-only echo injection whoami/id when stdout is reflected in JSON, or time-based check. !/usr/bin/env python3 -- coding:...

motionEye CVE-2025-60787 root command injection

CVE-2025-60787 motionEye /set with imagefilename $cmd — executed as root on the next interval snapshot. signingkey must be the SHA1 of the admin password same value stored as @adminpassword in motion.conf. !/usr/bin/env python3 -- coding: utf-8 -- """motionEye CVE-2025-60787 authenticated...

pyLoad CVE-2023-0297 pyimport RCE

CVE-2023-0297 pyLoad-ng 0.5.0b3.dev31: unauthenticated POST /flash/addcrypted2 evaluates the jk form field via js2py without disablepyimport, allowing pyimport os; os.system.... !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad CVE-2023-0297 pre-auth pyimport RCE via /flash/addcrypted2.""" from...

Teltonika RutOS ipsec status logread command injection

Post-authentication OS command injection in Teltonika RutOS 00.07.06.21 RUT2XX / RUT200; RUT9XX byte-identical ipsec.lua. GET /api/ipsec/status/ passes the URL-decoded sid into logread -e '-c|' without shell quoting; vuci.util.exec runs /bin/sh -c and returns stdout in JSON .data.logs reflective...

Samba CVE-2007-2447 usermap script RCE

CVE-2007-2447 Samba 3.0.20: SMB Session Setup username is passed unsanitized to username map script when configured — shell injection. !/usr/bin/env python3 -- coding: utf-8 -- """Samba CVE-2007-2447 username map script command injection.""" from future import annotations import socket import tim...

PHP2Shell (CVE-2026-109618/619) detection

Flags PHP versions in the CVE-2026-109618 / CVE-2026-109619 affected ranges. Confirm exploitation with exploits/multi/http/php2shellcve2026109618rce. !/usr/bin/env python3 -- coding: utf-8 -- """Detect PHP2Shell exposure CVE-2026-109618 / CVE-2026-109619.""" from future import annotations import ...

WordPress Unlimited Elements CVE-2026-103355 detect

Detects Unlimited Elements for Elementor = 2.0.20 CVE-2026-103355: terms-listing widget may concatenate parent-term IDs into SQL unvalidated. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Unlimited Elements for Elementor CVE-2026-103355 exposure.""" from kittysploit import from...

Wing FTP CVE-2025-47812 Detect

Detects Wing FTP web client authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Wing FTP web client authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Wing FTP...

nginx-ui CVE-2026-27944 backup encryption key leak

CVE-2026-27944 2.3.3: unauthenticated GET /api/backup returns a full system backup ZIP and exposes the AES key in the X-Backup-Security response header, allowing offline decryption of credentials and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-27944 — nginx-ui...

OpenSSL CVE-2014-0160 Heartbleed memory leak

CVE-2014-0160: malformed TLS heartbeat on OpenSSL 1.0.1–1.0.1f returns up to 64KB of process memory per request. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSSL CVE-2014-0160 Heartbleed TLS memory disclosure.""" from future import annotations from kittysploit import from lib.exploit.handler...

Bludit CVE-2019-16113 Detect

Detects Bludit admin login authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Bludit admin login authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Bludit CVE-2019-161...

Magento CVE-2015-1397 Shoplift admin SQLi

CVE-2015-1397 Magento CE = 1.9.0.1: stacked SQLi via CmsWysiwyg/directive/index creates a full admin user without SUPEE-5344. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift unauthenticated admin SQLi.""" from future import annotations import base64 import re from...

Binwalk CVE-2022-4510 Detect

Detects Binwalk web admin console authenticated plugin RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Binwalk web admin console authenticated plugin RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

XOR Shellcode Runner Evasion

Windows x64 EXE pure Zig: XOR-encrypted embedded shellcode, RW→RX, CreateThread. Compiled with the same Zig pipeline as zigshellevasion. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import compilezigpe, generatepayloadbytes, optionvalue,...

Hijack Opener

Redirect window.opener to the KittySploit hook page BeEF hijackopener from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "Hijack Opener", "description": "Redirect window.opener to the KittySploit hook page BeEF hijackopener", "author": "KittySploit Team", "browser":...

Next.js CVE-2024-34351 Server Actions SSRF

CVE-2024-34351 Next.js 13.4.0–14.1.0: Host-header Server Action redirect SSRF. Starts a local relay HEAD text/x-component, GET 302 to internalurl and POSTs with Next-Action to fetch internal content. !/usr/bin/env python3 -- coding: utf-8 -- """Next.js CVE-2024-34351 Server Actions SSRF via...

Ahsay CBS CVE-2026-105134 UpdateReceivers detect

Detects POST /rps/api/json/UpdateReceivers.do used in CVE-2026-105134 OS command injection via unsanitized random parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ahsay CBS-style UpdateReceivers endpoint CVE-2026-105134 pattern.""" import json from kittysploit import from...

Anuko Time Tracker CVE-2022-24707 Detect

Fingerprints Anuko Time Tracker login/register surface. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints Anuko Time Tracker login/register surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Anuko Time...

Fortinet FortiSandbox CVE-2026-39808 Detect

Fingerprints FortiSandbox web UI and the tracer-behavior endpoint associated with CVE-2026-39808 jid parameter command injection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect FortiSandbox CVE-2026-39808 tracer-behavior injection surface.""" from kittysploit import from...

Joomla DJ-Classifieds CVE-2026-61424 detect

Detects comdjclassifieds imageupload task CVE-2026-61424: unauthenticated file write to tmp/djupload/ in DJ-Classifieds 3.9.5. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla DJ-Classifieds CVE-2026-61424 imageupload exposure.""" from kittysploit import from lib.protocols.http.httpclie...

TensorFlow CVE-2024-3660 Detect

Heuristic for TensorFlow Serving / model upload APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Heuristic for TensorFlow Serving / model upload APIs.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "TensorFlow...

vm2 CVE-2023-30547 Detect

Heuristic for Node apps referencing vm2 sandbox RCE when user code runs. !/usr/bin/env python3 -- coding: utf-8 -- """Heuristic for Node apps referencing vm2 sandbox RCE when user code runs.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Callback Execution Evasion

Run decrypted shellcode through a Windows callback API EnumWindows or CreateTimerQueueTimer instead of CreateThread. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from lib.compile.callbackexecution...

Thread Pool Injection Evasion

Decrypt shellcode and queue it as a TpAllocWait/TpSetWait thread-pool callback no CreateThread on the payload path. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.compile.backdoorhelpers import buildencryptedzigbackdoor, optionvalue from lib.compile.threadpoolinjection...

Joomla Simple Membership CVE-2026-102782 SQL injection

CVE-2026-102782 comsimplemembership 7.4.0: unauthenticated SQL injection on task=checkLoginPass via the login parameter. Uses error-based extractvalue to leak SQL subquery results leak. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla OrdaSoft Simple Membership CVE-2026-102782 unauth SQLi."""...

WSO2 CVE-2026-5430 JWT alg:none admin bypass

CVE-2026-5430: forged alg:none JWT in X-JWT-Assertion grants access to WSO2 admin REST APIs applications, subscription keys. Confirmation / credential access — not arbitrary OS RCE. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 API Manager CVE-2026-5430 JWT alg:none admin API bypass.""" impor...

Cacti CVE-2025-24367 Detect

Fingerprints Cacti graph viewer authenticated RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints Cacti graph viewer authenticated RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Cacti...

HFS CVE-2014-6287 Detect

Detects HttpFileServer HFS web UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HttpFileServer HFS web UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "HFS CVE-2014-6287 Detect", "description": "Detects...

image-downloader CVE-2026-103648 wrapper detect

Detects Node.js apps exposing a user-controlled image URL fetch endpoint pattern associated with CVE-2026-103648 image-downloader 4.3.1 path traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Detect HTTP wrappers around vulnerable image-downloader 4.3.1.""" import json from kittysploit impor...

Metabase CVE-2026-72898 SQLi Detect

Probes POST /api/session/resetpassword for undeclared user-id :raw acceptance and optional pgsleep timing oracle. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2026-72898 resetpassword SQLi detection.""" from future import annotations import json import re import time from kittysploit...

Next.js CVE-2024-34351 Detect

Detects Next.js Server Actions / middleware headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Next.js Server Actions / middleware headers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Next.js...

WordPress Mail Mint CVE-2026-10196 Detect

Detects Mail Mint ≤ 1.31.0 CVE-2026-10196: plugin readme version and public mint-mail REST nonce on the site front page. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Mail Mint WordPress plugin CVE-2026-10196 exposure.""" import re from kittysploit import from lib.protocols.http.httpclient...

Fortinet FortiSandbox CVE-2026-39808 OS command injection

CVE-2026-39808 FortiSandbox 4.4.0–4.4.8: unauthenticated OS command injection via the jid query parameter on /fortisandbox/job-detail/tracer-behavior. Output is written to /web/ng/test.txt and retrieved over HTTP. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiSandbox CVE-2026-39808...

vm2 CVE-2023-30547 sandbox escape RCE

CVE-2023-30547 vm2 = 3.9.19: Proxy/getPrototypeOf recursion escapes the sandbox when a web app evaluates user code with vm2. !/usr/bin/env python3 -- coding: utf-8 -- """vm2 CVE-2023-30547 sandbox escape via HTTP code runner.""" from future import annotations import base64 import json import re...

WordPress Mail Mint CVE-2026-10196 POP RCE

CVE-2026-10196 Mail Mint ≤ 1.31.0: unauthenticated mint-form-submit stores a serialized PostHog ForkCurl object; maybeunserialize triggers exec via curl host injection. Requires public wprest nonce from a page with Mail Mint form. !/usr/bin/env python3 -- coding: utf-8 -- """Mail Mint WordPress...

Adobe ColdFusion CVE-2009-2265 FCKeditor upload RCE

CVE-2009-2265: unauthenticated FCKeditor upload.cfm with null-byte CurrentFolder bypass drops JSP under /userfiles/file/ for cmd execution. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion 8 CVE-2009-2265 FCKeditor unauth upload RCE.""" from future import annotations from kittysploit...

ISPConfig CVE-2023-46818 language_edit RCE

CVE-2023-46818 ISPConfig = 3.2.11: authenticated injection in admin/languageedit.php records writes admin/sh.php passthru shell. !/usr/bin/env python3 -- coding: utf-8 -- """ISPConfig CVE-2023-46818 authenticated languageedit.php code injection.""" from future import annotations import base64...

OP5 Monitor CVE-2025-34115 command_test RCE

CVE-2025-34115 bypass: authenticated cmdstr on /monitor/op5/nacoma/commandtest.php runs $... via naemon shell mode. !/usr/bin/env python3 -- coding: utf-8 -- """ITRS OP5 Monitor CVE-2025-34115 patch-bypass commandtest RCE.""" from future import annotations import base64 import re from kittysploit...

Webmin CVE-2019-12840 Package Updates RCE

CVE-2019-12840: authenticated command injection in POST /package-updates/update.cgi via slash-free base32-decoded shell in the u= parameter Webmin = 1.920. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin CVE-2019-12840 authenticated Package Updates command injection.""" from future import...