Appspec YML/YAML - Detect

Appspec YML and YAML files are susceptible to information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Appspec YML and YAML files are susceptible to information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

ASP.NET Launch Settings - Exposure Detection

Detected exposed launchSettings.json files in ASP.NET Core applications. This file contains environment variables and launch configurations that may leak sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed launchSettings.""" from kittysploit import from...

librechat - Config Exposure Detection

Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially exposing internal configuration details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially...

HTaccess config file Detection

Detects HTaccess config file. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HTaccess config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HTaccess config file Detection', 'description': 'Detects HTacce...

Github pages config file Detection

Find github pages config file. !/usr/bin/env python3 -- coding: utf-8 -- """Find github pages config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Github pages config file Detection', 'description': 'Find...

Jetbrains IDE DataSources Config - Detect

Jetbrains IDE DataSources configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jetbrains IDE DataSources configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Php User.ini Disclosure Detection

PHP user.ini file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP user.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Php User.ini Disclosure Detection', 'description': 'PHP user.ini file is exposed.',...

D-Link DCS - Unauth Credential Disclosure Detection (CVE-2020-25078)

Detects CVE-2020-25078 by requesting /config/getuser?index=0 and looking for name=/pass= credential lines without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DCS IP camera credential disclosure via /config/getuser CVE-2020-25078.""" import re from kittysploit import from...

CircleCI SSH Configuration - Detect

CircleCI ssh-config file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CircleCI ssh-config file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CircleCI SSH Configuration - Detect',...

Spring Cloud Config Server - Local File Inclusion Detection

Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafte...

CVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

libssh-config-0.11.5-1.1 on GA media (moderate)

libssh-config-0.11.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11377-1 Rating: moderate Cross-References: CVE-2026-15370 CVE-2026-59843 CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-59849 CVE-2026-59850 CVSS scores: CVE-2026-15370 SUSE : 6.7...

PT-2026-65500

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

PT-2026-65570

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

Malicious Package

Overview bcore-bravo-eslint-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview pfa-prettier-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cryptodao-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview atlasora-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zomato-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ichnology-link-config-neutronstar is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...