FreePBX - API handler system() Detection (CVE-2014-1903)

Detects CVE-2014-1903 by calling /admin/config.php handler=api function=system with args=id and matching uid=. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX admin API handler system RCE CVE-2014-1903.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

FreePBX - API handler system() RCE (CVE-2014-1903)

Exploits CVE-2014-1903 via /admin/config.php handler=api function=system. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX API handler system RCE CVE-2014-1903 — opens execute session.""" import re from urllib.parse import quote from kittysploit import fr...

EUVD-2026-49989

The SpeedyCache plugin for WordPress is vulnerable to Arbitrary File Read via Path Traversal in all versions up to, and including, 1.3.8. This is due to a mismatch between CSS URL validation which allows query strings like .css?... and path resolution which strips query strings, combined with no...

WordPress True Ranker <2.2.4 - Local File Inclusion Detection

WordPress True Ranker before version 2.2.4 allows sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the /admin/vendor/datatables/examples/resources/examples.php file via local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

DedeCMS 5.7 - Cross-Site Scripting Detection

DeDeCMS 5.7 contains a cross-site scripting vulnerability in the '/include/dialog/config.php' file. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """DeDeCMS 5.""" from kittysploit impo...

AWS S3 keys Leak Detection

AWS S3 keys are exposed. !/usr/bin/env python3 -- coding: utf-8 -- """AWS S3 keys are exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS S3 keys Leak Detection', 'description': 'AWS S3 keys are exposed.',...

Pulsar360 Admin Panel - Detect

Pulsar360 admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Pulsar360 admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pulsar360 Admin Panel - Detect', 'description':...

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion Detection

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't...

NeDi 1.9C - Cross-Site Scripting Detection

NeDi 1.9C is vulnerable to cross-site scripting because of an incorrect implementation of sanitize in inc/libmisc.php. This function attempts to escape the SCRIPT tag from user-controllable values, but can be easily bypassed, as demonstrated by an onerror attribute of an IMG element as a...

Patreon WordPress <1.7.0 - Unauthenticated Local File Inclusion Detection

Patreon WordPress before version 1.7.0 is vulnerable to unauthenticated local file inclusion that could be abused by anyone visiting the site. Exploitation by an attacker could leak important internal files like wp-config.php, which contains database credentials and cryptographic keys used in the...

WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion Detection

WordPress Advanced Access Manager versions before 5.9.9 are vulnerable to local file inclusion and allows attackers to download the wp-config.php file and get access to the database, which is publicly reachable on many servers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Acces...

CVE-2026-13693

The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file...

NukeViet: Path Traversal to Arbitrary File Deletion in Edit Comment Function

Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., config.php by injecting a crafted attach parameter, rendering the application inoperable. Affected Component...

PT-2026-58960

Summary Path Traversal to Arbitrary File Deletion in the Edit Comment admin function. An authenticated administrator can delete arbitrary files within the application root e.g., config.php by injecting a crafted attach parameter, rendering the application inoperable. Affected Component...

Exploit for Cross-site Scripting in Combodo Itop

CVE-2023-36664: Ghostscript Remote Code Execution 취약점 요약...

CVE-2026-12277

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-12277 Frontend File Manager Plugin <= 23.6 - Unauthenticated Arbitrary File Deletion via Saved File Metadata Path Traversal

The Frontend File Manager Plugin WordPress plugin through 23.6 does not validate a file path derived from user input before deleting the referenced file, allowing unauthenticated users to delete arbitrary files on the server such as wp-config.php when guest upload mode is enabled. Deleting...

CVE-2026-43921 FOSSBilling vulnerable to arbitrary PHP code injection via unescaped config serialization

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's Config::prettyPrintArrayToPHP method. When configuration values are updated, string values are written into config.php without escaping...

CVE-2026-43921

FOSSBilling is affected by a PHP code injection in versions 0.6.10–0.7.2 via Config::prettyPrintArrayToPHP(), where updated configuration values are written to config.php without escaping single quotes. Because config.php is loaded with a bare include on each HTTP request, an admin with privilege...

EUVD-2026-41961

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.10 through 0.7.2 have a PHP code injection vulnerability in FOSSBilling's Config::prettyPrintArrayToPHP method. When configuration values are updated, string values are written into config.php without escaping...