Apache ShardingSphere ElasticJob-UI privilege escalation Detection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. This issue affects Apache ShardingSphere ElasticJob-UI Apache ShardingSphere ElasticJob-UI 3.x version 3.0.0 and pri...

Nortek Linear eMerge E3-Series - Cross-Site Scripting Detection

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. !/usr/bin/env python3 -- coding: utf-8 -- """There is a local session fixation vulnerability that, when chained with cross-site scripting,...

Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access Detection

Tieline IP Audio Gateway 2.6.4.8 and below is affected by a vulnerability in the web administrative interface that could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. !/usr/bin/env python3 -- coding: utf-8 -- """Tieline IP Audio Gateway 2."...

Zimbra Collaboration - Unrestricted File Upload Detection

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

Palo Alto Expedition - Admin Account Takeover Detection

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. !/usr/bin/env python3 -- coding: utf-8 -- """Missing authentication for a critical function in Palo Alto Networks...

Netgear-WN604 downloadFile.php - Information Disclosure Detection

There is an information leakage vulnerability in the downloadFile.php interface of Netgear WN604. A remote attacker using file authentication can use this vulnerability to obtain the administrator account and password information of the wireless router, causing the router's background to be...

SQL Monitor - Discovery Detection

SQL Monitor was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """SQL Monitor was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SQL Monitor - Discovery Detection', 'description': 'SQL Monitor was...

Ruijie EG Easy Gateway - Remote Command Execution Detection

Ruijie EG Easy Gateway login.php has remote commmand execution vulnerability, which can lead to the disclosure of administrator account and password. !/usr/bin/env python3 -- coding: utf-8 -- """Ruijie EG Easy Gateway login.""" from kittysploit import from lib.protocols.http.httpclient import...

Service Account Credentials File Disclosure Detection

Service Account Credentials internal file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Service Account Credentials internal file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Service Account...

Socks5 VPN - Sensitive File Disclosure Detection

Information Leakage in the Socks5 VPN login system of Wheilton e-Ditong, and the administrator account password can be obtained by visiting a specially crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """Information Leakage in the Socks5 VPN login system of Wheilton e-Ditong, and the...

Leantime - Unfinished Installation Detection

Detected a Leantime instance identified with the setup installation page accessible at /install, enabling unauthenticated users to create the first administrator account and configure the database. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a Leantime instance identified with the setup...

Lvmeng - UTS Disclosure Detection

Lvmeng UTS was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Lvmeng UTS was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lvmeng - UTS Disclosure Detection', 'description': 'Lvmeng UTS was...

HIKVISION iSecure Center - Information Leak Detection

HIKVISION iSecure Center comprehensive security management platform is an "integrated" and "intelligent" platform. By accessing equipment such as video surveillance, all-in-one card, parking lot, alarm detection and other systems, Hikvision comprehensive security management platform information...

IBM Websphere Friendly Path Exposure Detection

Finds friendly path exposed that can be used to access signup page and create new user accounts. !/usr/bin/env python3 -- coding: utf-8 -- """Finds friendly path exposed that can be used to access signup page and create new user accounts.""" import re from kittysploit import from...

Unity Plastic SCM Login Panel - Detect

Unity Plastic SCM login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Unity Plastic SCM login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unity Plastic SCM Login Panel -...

CVE-2026-58332

A flaw was found in Moodle. This vulnerability allows an authenticated attacker to bypass another user's email-based multi-factor authentication MFA token check. While valid login credentials are still required, successful exploitation could lead to unauthorized access to another user's account...

CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-14169

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...

CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...

CVE-2026-14169 ads-tec Industrial IT: Account lockout via non-atomic user creation

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device...