Joomla! Component WMI 1.5.0 - Local File Inclusion Detection

A directory traversal vulnerability in wmi.php in the Webmoney Web Merchant Interface aka WMI or comwmi component 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-...

Joomla! Component com_jresearch - 'Controller' Local File Inclusion Detection

A directory traversal vulnerability in jresearch.php in the J!Research comjresearch component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in...

Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion Detection

A directory traversal vulnerability in the givesight PowerMail Pro compowermail component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8...

Joomla! Component DW Graph - Local File Inclusion Detection

A directory traversal vulnerability in dwgraphs.php in the DecryptWeb DW Graphs comdwgraphs component 1.0 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A director...

Mini Mouse 9.2.0 - Local File Inclusion Detection

Mini Mouse 9.2.0 is vulnerable to local file inclusion because it allows remote unauthenticated attackers to include and disclose the content of locally stored files via the 'file' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Mini Mouse 9.""" from kittysploit import from...

Thruk Monitoring Webinterface - Cross-Site Scripting Detection

Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/cgi-bin/login.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Thruk Monitoring Webinterface contains a cross-site scripting vulnerability via the login parameter at /thruk/.""" from...

TamronOS IPTV/VOD - Remote Command Execution Detection

TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """TamronOS IPTV/VOD contains a remote command execution in the 'host' parameter of the /api/ping endpoint.""" import re from kittysploit import from...

Vehicle Parking Management System 1.0 - SQL Injection Detection

Vehicle Parking Management System 1.0 contains a SQL injection vulnerability via the password parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python...

Joomla! Component jesectionfinder - Local File Inclusion Detection

A directory traversal vulnerability in the JExtensions JE Section/Property Finder jesectionfinder component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php. !/usr/bin/env python3 -- coding: utf-8...

WordPress Plugin Tera Charts - Local File Inclusion Detection

Multiple local file inclusion vulnerabilities in Tera Charts tera-charts plugin 0.1 for WordPress allow remote attackers to read arbitrary files via a .. dot dot in the fn parameter to 1 charts/treemap.php or 2 charts/zoomabletreemap.php. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple loca...

ScoreMe Theme - Cross-Site Scripting Detection

WordPress ScoreMe theme through 2016-04-01 contains a reflected cross-site scripting vulnerability via the s parameter which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal...

WSO2 Carbon Management Console <=5.10 - Cross-Site Scripting Detection

WSO2 Management Console through 5.10 is susceptible to reflected cross-site scripting which can be exploited by tampering a request parameter in Management Console. This can be performed in both authenticated and unauthenticated requests. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 Manageme...

WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting Detection

WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter a search query. Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean...

Novius OS 5.0.1-elche - Open Redirect Detection

Novius OS 5.0.1 Elche allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to admin/nos/login. !/usr/bin/env python3 -- coding: utf-8 -- """Novius OS 5.""" import re from kittysploit import from...

WordPress StageShow <5.0.9 - Open Redirect Detection

WordPress StageShow plugin before 5.0.9 contains an open redirect vulnerability in the Redirect function in stageshowredirect.php. A remote attacker can redirect users to arbitrary web sites and conduct phishing attacks via a malicious URL in the url parameter. !/usr/bin/env python3 -- coding:...

WordPress Laborator Neon Theme 2.0 - Cross-Site Scripting Detection

WordPress Laborator Neon theme 2.0 contains a cross-site scripting vulnerability via the data/autosuggest-remote.php q parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Laborator Neon theme 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting Detection

WordPress Hero Maps Premium plugin 2.2.1 and prior contains an unauthenticated reflected cross-site scripting vulnerability via the views/dashboard/index.php p parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Hero Maps Premium plugin 2.""" from kittysploit import from...

WordPress API Bearer Auth <20190907 - Cross-Site Scripting Detection

WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting vulnerability. The server parameter is not correctly filtered in swagger-config.yaml.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress API Bearer Auth plugin before 20190907 contains a cross-site scripting...

WP AmASIN – The Amazon Affiliate Shop - Local File Inclusion Detection

Absolute path traversal vulnerability in reviews.php in the WP AmASIN - The Amazon Affiliate Shop plugin 0.9.6 and earlier for WordPress allows remote attackers to read arbitrary files via a full pathname in the url parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Absolute path traversal...

Cross RSS 1.7 - Local File Inclusion Detection

Absolute path traversal vulnerability in Cross-RSS wp-cross-rss plugin 1.7 for WordPress allows remote attackers to read arbitrary files via a full pathname in the rss parameter to proxy.php. !/usr/bin/env python3 -- coding: utf-8 -- """Absolute path traversal vulnerability in Cross-RSS...