ManageEngine ServiceDesk 9.3.9328 - Arbitrary File Retrieval Detection

ManageEngine ServiceDesk 9.3.9328 is vulnerable to an arbitrary file retrieval due to improper restrictions of the pathname used in the name parameter for the download-snapshot path. An unauthenticated remote attacker can use this vulnerability to download arbitrary files. !/usr/bin/env python3 -...

IceWarp WebMail 11.3.1.5 - Cross-Site Scripting Detection

IceWarp WebMail 11.3.1.5 is vulnerable to cross-site scripting via the language parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebMail 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp...

Mautic <3.3.4 - Cross-Site Scripting Detection

Mautic before 3.3.4 contains a cross-site scripting vulnerability on the password reset page in the bundle parameter of the URL. An attacker can inject arbitrary script, steal cookie-based authentication credentials, and/or launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Mautic...

Noptin < 1.6.5 - Open Redirect Detection

Noptin 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. !/usr/bin/env python3 -- coding: utf-8 -- """Noptin 1.""" import re from kittysploit import from...

WordPress Transposh Translation <1.0.8 - Cross-Site Scripting Detection

WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in...

Academy Learning Management System <5.9.1 - Cross-Site Scripting Detection

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

myfactory FMS - Cross-Site Scripting Detection

myfactory.FMS before 7.1-912 allows cross-site scripting via the Error parameter. !/usr/bin/env python3 -- coding: utf-8 -- """myfactory.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myfactory FMS - Cross-Site...

XWiki < 14.10.5 - Cross-Site Scripting Detection

XWiki Platform is vulnerable to reflected XSS via the previewactions template. An attacker can inject JavaScript through the xcontinue parameter. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is vulnerable to reflected XSS via the previewactions template.""" from kittysploit import...

Webkul QloApps 1.6.0 - Cross-site Scripting Detection

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated Cross-Site Scripting XSS...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting Detection

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Icewarp Icearp v10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

JeecgBoot 3.5.0 - SQL Injection Detection

jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. !/usr/bin/env python3 -- coding: utf-8 -- """jeecg-boot 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

WordPress Videos sync PDF <=1.7.4 - Local File Inclusion Detection

WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Videos sync PDF 1.""" from kittysploit import from lib.protocols.http.httpclient...

WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting Detection

WordPress Shortcodes and extra features plugin for the Phlox theme before 2.9.8 contains a cross-site scripting vulnerability. The plugin does not sanitize and escape a parameter before outputting it back in the response. An attacker can inject arbitrary script in the browser of an unsuspecting...

ATutor < 2.2.1 - Cross Site Scripting Detection

ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ATutor 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

Jeecg-Boot v3.5.1 - SQL Injection Detection

SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.5.1. !/usr/bin/env python3 -- coding: utf-8 -- """SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData in jeecg-boot v3.""" from kittysploit import from...

IceWarp 11.4.6.0 - Cross-Site Scripting Detection

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Stable Diffusion Webui 1.10.0 - Open Redirect Detection

An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. !/usr/bin/env python...

Gradio - Server Side Request Forgery Detection

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

IceWarp WebMail 11.4.5.0 - Cross-Site Scripting Detection

IceWarp WebMail 11.4.5.0 is vulnerable to cross-site scripting via the language parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebMail 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...