EUVD-2026-49766

Quick.Cart stores hard-coded, plaintext admin credentials in a configuration file. This flaw allows attackers with access to the server file system to retrieve authentication details, potentially leading to privilege escalation. The vendor assessed the likelihood of exploitation as very low and...

Github pages config file Detection

Find github pages config file. !/usr/bin/env python3 -- coding: utf-8 -- """Find github pages config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Github pages config file Detection', 'description': 'Find...

Coremail - Config Discovery Detection

Coremail configuration information was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Coremail configuration information was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Coremail - Config...

Php User.ini Disclosure Detection

PHP user.ini file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP user.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Php User.ini Disclosure Detection', 'description': 'PHP user.ini file is exposed.',...

CircleCI Configuration File - Detect

CircleCI config.yml file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CircleCI config.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CircleCI Configuration File - Detect', 'description': 'CircleCI...

Tox Configuration File - Detect

Tox configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tox configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tox Configuration File - Detect', 'description':...

Spring Cloud Config Server - Local File Inclusion Detection

Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafte...

Jetbrains IDE DataSources Config - Detect

Jetbrains IDE DataSources configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jetbrains IDE DataSources configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

HTaccess config file Detection

Detects HTaccess config file. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HTaccess config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HTaccess config file Detection', 'description': 'Detects HTacce...

Karma Configuration File - Detect

Karma configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Karma configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Karma Configuration File - Detect',...

librechat - Config Exposure Detection

Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially exposing internal configuration details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially...

AWS Configuration - Detect

AWS config found via /.aws/config. !/usr/bin/env python3 -- coding: utf-8 -- """AWS config found via /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Configuration - Detect', 'description': 'AWS confi...

Appspec YML/YAML - Detect

Appspec YML and YAML files are susceptible to information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Appspec YML and YAML files are susceptible to information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

ASP.NET Launch Settings - Exposure Detection

Detected exposed launchSettings.json files in ASP.NET Core applications. This file contains environment variables and launch configurations that may leak sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed launchSettings.""" from kittysploit import from...

Build Properties File Exposure Detection

Detects Build Properties File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Build Properties File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Build Properties File Exposure Detection',...

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) Detection

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. !/usr/bin/env python3 -- coding: utf-8 -- """Reflective Cross Site Scripting XSS...

Anchor CMS 0.12.3 - Error Log Exposure Detection

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. !/usr/bin/env python3 -- coding: utf-8 --...

pyLoad Flask Config - Access Control Detection

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77. !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad...

Dnsmasq Config - File Disclosure Detection

Dnsmasq Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Dnsmasq Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dnsmasq Config - File Disclosure Detection', 'description':...

Detect .dockercfg

Docker registry authentication data !/usr/bin/env python3 -- coding: utf-8 -- """Docker registry authentication data.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect .dockercfg', 'description': 'Docker registr...