MajorDoMo - Unauthenticated RCE Detection

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a remote...

Hybris Management Console Login Panel - Detect

Hybris Management Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hybris Management Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hybris Management...

Dialogic XMS Admin Console - Detect

Detects Dialogic XMS Admin Console - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dialogic XMS Admin Console - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dialogic XMS Admin Console -...

SonicWall Appliance Management Console Login Panel - Detect

SonicWall Appliance Management Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall Appliance Management Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OpenBao Web UI Panel - Detect

Detects the presence of the OpenBao web console. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the OpenBao web console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenBao Web UI Panel -...

Apache Apollo Panel - Detect

Detects Apache Apollo Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache Apollo Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Apollo Panel - Detect', 'description':...

CLink Office 2.0 - Cross-Site Scripting Detection

CLink Office 2.0 is vulnerable to cross-site scripting in the index page of the management console and allows remote attackers to inject arbitrary web script or HTML via the lang parameter. !/usr/bin/env python3 -- coding: utf-8 -- """CLink Office 2.""" from kittysploit import from...

Oracle iPlanet Web Server 7.0.x - Authentication Bypass Detection

Oracle iPlanet Web Server 7.0.x has incorrect access control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. NOTE a related support policy can be found in the www.oracle.com references attached to this CVE. !/usr/bin/env...

MinIO Operator Console Authentication Bypass Detection

MinIO Console is a graphical user interface for the for MinIO Operator. MinIO itself is a multi-cloud object storage project. Affected versions are subject to an authentication bypass issue in the Operator Console when an external IDP is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """MinIO...

i-Panel Administration System 2.0 - Cross-Site Scripting Detection

i-Panel Administration System 2.0 contains a cross-site scripting vulnerability that enables an attacker to execute arbitrary JavaScript code in the browser-based web console. !/usr/bin/env python3 -- coding: utf-8 -- """i-Panel Administration System 2.""" from kittysploit import from...

WSO2 - Cross-Site Scripting Detection

WSO2 contains a reflected cross-site scripting vulnerability in the Management Console of API Manager 2.2.0, 2.5.0, 2.6.0, 3.0.0, 3.1.0, 3.2.0, and 4.0.0; API Manager Analytics 2.2.0, 2.5.0, and 2.6.0; API Microgateway 2.2.0; Data Analytics Server 3.2.0; Enterprise Integrator 6.2.0, 6.3.0, 6.4.0,...

Adobe ColdFusion 8.0/8.0.1/9.0/9.0.1 LFI Detection

Multiple directory traversal vulnerabilities in the administrator console in Adobe ColdFusion 9.0.1 and earlier allow remote attackers to read arbitrary files via the locale parameter to 1 CFIDE/administrator/settings/mappings.cfm, 2 logging/settings.cfm, 3 datasources/index.cfm, 4...

Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting Detection

Oracle Secure Global Desktop Administration Console 4.4 contains a reflected cross-site scripting vulnerability in helpwindow.jsp via all parameters, as demonstrated by the sgdadmin/faces/comsunwebui/help/helpwindow.jsp windowTitle parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle...

FlureeDB Admin Console Login Panel - Detect

FlureeDB Admin Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FlureeDB Admin Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FlureeDB Admin Console...

Hybris Administration Console Login Panel - Detect

Hybris Administration Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hybris Administration Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hybris...

IBM Decision Center Enterprise Console - Panel Detection

IBM Decision Center Enterprise Console panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Decision Center Enterprise Console panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IBM...

Infinispan Console - Detection

Infinispan is an open-source in-memory data grid by Red Hat that exposes a management console under /console/welcome and a REST API under /rest/v2/ on the default port 11222. This template fingerprints Infinispan by matching the unique HTML console markers and the Digest authentication challenge...

NetScaler Console - Sensitive Information Disclosure Detection

Sensitive information disclosure in NetScaler Console !/usr/bin/env python3 -- coding: utf-8 -- """Sensitive information disclosure in NetScaler Console.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NetScaler...

Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component Detection

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component. !/usr/bin/env python3 -- coding: utf-8 -- """SQL injection vulnerability in vipshop Saturn v.""" from kittysploit import...

WSO2 Management Console - Authentication Bypass Detection

An authentication bypass vulnerability exists in the Management Console of multiple WSO2 products. A malicious actor with access to the console can manipulate the request URI to bypass authentication and access certain restricted resources, resulting in partial information disclosure. The known...