LG SuperSign EZ CMS 2.5 - Local File Inclusion Detection

LG SuperSign CMS 2.5 allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs - aka local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """LG SuperSign CMS 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Anchor CMS 0.12.3 - Error Log Exposure Detection

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. !/usr/bin/env python3 -- coding: utf-8 --...

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset Detection

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. !/usr/bin/env python3 -- coding: utf-8 -- """strapi CMS before 3.""" from...

Kentico Xperience 13 CMS - Staging None-password Authentication Bypass

Kentico Staging SyncServer None-type password handling auth bypass WT-2025-0006. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging None-password Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

EP Web Solutions CMS - Cross Site Scripting Detection

Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of...

GetSimple CMS Detection

Template to detect a running GetSimple CMS instance !/usr/bin/env python3 -- coding: utf-8 -- """Template to detect a running GetSimple CMS instance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GetSimple CMS...

GetSimple CMS - Installer Detection

GetSimple CMS installer was found. !/usr/bin/env python3 -- coding: utf-8 -- """GetSimple CMS installer was found.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GetSimple CMS - Installer Detection', 'description':...

Gnuboard CMS - Detect

Gnuboard CMS was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard CMS was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Gnuboard CMS - Detect', 'description': 'Gnuboard CMS was detected.',...

Indonasia Toko CMS - SQL Injection Detection

Indonesia Toko CMS is susceptible to SQL Injection in its login system, enabling attackers to exploit vulnerabilities and bypass authentication by injecting malicious SQL code. !/usr/bin/env python3 -- coding: utf-8 -- """Indonesia Toko CMS is susceptible to SQL Injection in its login system,...

dotAdmin Login Panel- Detect

dotAdmin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """dotAdmin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'dotAdmin Login Panel- Detect', 'description': 'dotAdm...

ApostropheCMS - Detect

Detected the presence of ApostropheCMS, a full-stack content management system built on Node.js and MongoDB. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of ApostropheCMS, a full-stack content management system built on Node.""" import re from kittysploit import from...

Asanhamayesh CMS 3.4.6 - Local File Inclusion Detection

Asanhamayesh CMS 3.4.6 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Asanhamayesh CMS 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Asanhamayesh CMS 3.4.6 - Local...

Batflat SQLite Database - Exposure Detection

Detected exposed Batflat CMS SQLite database files that may contain sensitive information including admin credentials, user data, site configuration, and content. Batflat stores its database in the /inc/data/ directory by default. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed...

Call Break CMS Panel - Detect

Call Break CMS panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Call Break CMS panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Call Break CMS Panel - Detect', 'description': 'Call...

Craft CMS Detect

Detects Craft CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Craft CMS.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Detect', 'description': 'Detects Craft CMS', 'author': 'KittySploi...

Tiki Wiki CMS Groupware 5.2 - Local File Inclusion Detection

Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tiki Wiki CM...

Craft CMS - Log File Disclosure Detection

Detected exposed Craft CMS log files due to misconfiguration, allowing unauthenticated access to sensitive information including error messages, stack traces, database queries, and potentially credentials or session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Craft CMS log...

Lokomedia CMS - Local File Inclusion Detection

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """A Local File Inclusion LFI vulnerability exis...

Monstra CMS 3.0.4 - HTTP Header Injection Detection

Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to...

Magnolia CMS Login Panel - Detect

Magnolia CMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Magnolia CMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Magnolia CMS Login Panel - Detect',...