PHP End-of-Life - Detect

Detected PHP versions that have reached End-of-Life EOL and no longer receive security updates. !/usr/bin/env python3 -- coding: utf-8 -- """Detected PHP versions that have reached End-of-Life EOL and no longer receive security updates.""" from kittysploit import from lib.protocols.http.httpclien...

PHP Fusion Detect

Detects PHP Fusion Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP Fusion Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Fusion Detect', 'description': 'Detects PHP Fusion Detect.',...

PHP Prober - Exposure Detection

PHP Prober Server exposure was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Prober Server exposure was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Prober - Exposure Detection',...

PHP Proxy Detect

Detects PHP Proxy Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP Proxy Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Proxy Detect', 'description': 'Detects PHP Proxy Detect.', 'author'...

PEAR Registry Files Exposed Detection

Detected exposed PEAR registry files .reg containing serialized PHP metadata, including package versions and local paths. This exposure facilitated supply-chain reconnaissance by revealing installed dependencies and system mappings. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed PE...

PHP Composer Binary - Exposure Detection

This Nuclei template checks if the specified endpoints have publically accessible PHP Composer Binary. !/usr/bin/env python3 -- coding: utf-8 -- """This Nuclei template checks if the specified endpoints have publically accessible PHP Composer Binary.""" from kittysploit import from...

PHP-CS-Fixer Cache - File Disclosure Detection

PHP CS fixer cache internal file is disclosed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP CS fixer cache internal file is disclosed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP-CS-Fixer Cache - File...

PHP-FPM Configuration Page - Detect

PHP-FPM configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-FPM configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP-FPM Configuration Page - Detect',...

PHP-FPM Status Detection

Detects PHP-FPM Status. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP-FPM Status.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP-FPM Status Detection', 'description': 'Detects PHP-FPM Status.',...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

PhpMyAdmin Scripts - Remote Code Execution Detection

PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow...

Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion Detection

A PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites comjoomla-visites component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A PHP...

WordPress Plugin DukaPress 2.5.2 - Directory Traversal Detection

A directory traversal vulnerability in the dpimgresize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the src parameter to lib/dpimage.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Joomla HTTP Header Unauthenticated - Remote Code Execution Detection

Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015 !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! 1.""" from kittysploit import from...

WordPress Mailster <=1.5.4 - Cross-Site Scripting Detection

WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Mailster 1.""" from kittysploit import from lib.protocols.http.httpclien...

uWSGI PHP Plugin Local File Inclusion Detection

uWSGI PHP Plugin before 2.0.17 mishandles a DOCUMENTROOT check during use of the --php-docroot option, making it susceptible to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """uWSGI PHP Plugin before 2.""" import re from kittysploit import from lib.protocols.http.httpclient...

shadoweb wdja v1.5.1 - Cross-Site Scripting Detection

shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """shadoweb wdja v1.""" from kittysploit import from...

WP Hotel Booking < 1.10.4 - PHP Object Injection Detection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. !/usr/bin/env python3 -- coding: utf-8 -- """The wp-hotel-booking plugin...

Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion Detection

Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Zeta Producer Desktop CMS before 14.""" import r...

PHP Proxy 3.0.3 - Local File Inclusion Detection

PHP Proxy 3.0.3 is susceptible to local file inclusion vulnerabilities that allow unauthenticated users to read files from the server via index.php?q=file:/// a different vulnerability than CVE-2018-19246. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Proxy 3.""" import re from kittysploit...