WordPress White Label CMS <2.2.9 - Cross-Site Scripting Detection

WordPress White Label CMS plugin before 2.2.9 contains a reflected cross-site scripting vulnerability. It does not sanitize and validate the wlcmslogincustomjs parameter before outputting it back in the response while previewing. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress White Label...

Sitecore CMS - Cross-Site Scripting Detection

Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack. !/usr/bin/env python3 -- coding: utf-8 -- """Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of...

Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion Detection

Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Zeta Producer Desktop CMS before 14.""" import r...

Processwire CMS <2.7.1 - Local File Inclusion Detection

Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """Processwire CMS prior to 2.""" import re from kittysploit import from...

Lotus Core CMS 1.0.1 - Local File Inclusion Detection

Lotus Core CMS 1.0.1 allows authenticated local file inclusion of .php files via directory traversal in the index.php pageslug parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Lotus Core CMS 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Clansphere CMS 2011.4 - Cross-Site Scripting Detection

Clansphere CMS 2011.4 contains an unauthenticated reflected cross-site scripting vulnerability via the "language" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Clansphere CMS 2011.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Ghost CMS <=4.32 - Cross-Site Scripting Detection

Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code. !/usr/bin/env python3 -- coding: utf-8 -- """Ghost CMS 4."""...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...

Mingsoft MCMS - SQL Injection Detection

SQL injection vulnerability in Mingsoft MCMS up to 5.2.9 via the sqlWhere parameter in /cms/category/list. !/usr/bin/env python3 -- coding: utf-8 -- """SQL injection vulnerability in Mingsoft MCMS up to 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BlogEngine CMS - Open Redirect Detection

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect !/usr/bin/env python3 -- coding: utf-8 -- """Blogengine.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BlogEngine CMS - Open Redirect...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting Detection

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

LG SuperSign EZ CMS 2.5 - Local File Inclusion Detection

LG SuperSign CMS 2.5 allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs - aka local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """LG SuperSign CMS 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Anchor CMS 0.12.3 - Error Log Exposure Detection

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. !/usr/bin/env python3 -- coding: utf-8 --...

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset Detection

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. !/usr/bin/env python3 -- coding: utf-8 -- """strapi CMS before 3.""" from...

Kentico Xperience 13 CMS - Staging None-password Authentication Bypass

Kentico Staging SyncServer None-type password handling auth bypass WT-2025-0006. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging None-password Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

EP Web Solutions CMS - Cross Site Scripting Detection

Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of...

GetSimple CMS Detection

Template to detect a running GetSimple CMS instance !/usr/bin/env python3 -- coding: utf-8 -- """Template to detect a running GetSimple CMS instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GetSimple CMS...

GetSimple CMS - Installer Detection

GetSimple CMS installer was found. !/usr/bin/env python3 -- coding: utf-8 -- """GetSimple CMS installer was found.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GetSimple CMS - Installer Detection', 'description':...

Gnuboard CMS - Detect

Gnuboard CMS was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard CMS was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Gnuboard CMS - Detect', 'description': 'Gnuboard CMS was detected.',...

Indonasia Toko CMS - SQL Injection Detection

Indonesia Toko CMS is susceptible to SQL Injection in its login system, enabling attackers to exploit vulnerabilities and bypass authentication by injecting malicious SQL code. !/usr/bin/env python3 -- coding: utf-8 -- """Indonesia Toko CMS is susceptible to SQL Injection in its login system,...