Spring Boot H2 Database - Remote Command Execution Detection

Spring Boot H2 Database is susceptible to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot H2 Database is susceptible to remote code execution.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection Detection

The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

Database Error Detection

Detects Database Error. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Database Error.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Database Error Detection', 'description': 'Detects Database Error.',...

Exposed JSON Configuration Files Detection

Detects exposed JSON configuration files containing sensitive information including API keys, access tokens, AWS credentials, database configurations, base URLs, file paths, and application settings. These files often contain production configurations and credentials that should not be publicly...

Clockwork PHP page exposure Detection

Clockwork php page was exposed, which allows admins to profile and debug the application, view database queries, HTTP requests, and other details right from the browser's developer tools. !/usr/bin/env python3 -- coding: utf-8 -- """Clockwork php page was exposed, which allows admins to profile a...

TCExam <= 14.8.1 - Sensitive Information Exposure Detection

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files. !/usr/bin/env python3 -- coding: utf-8 -- """When installed following the default/recommended settings,...

Hongfan OA udfmr.asmx - SQL injection Detection

There is a SQL injection vulnerability in Hongfan iOffice 10 Hospital Edition, which can be exploited by attackers to obtain sensitive database information. !/usr/bin/env python3 -- coding: utf-8 -- """There is a SQL injection vulnerability in Hongfan iOffice 10 Hospital Edition, which can be...

Exposed Prisma Database Schema - Exposure Detection

Prisma is a modern ORM extremely popular in the Node.js and TypeScript Next.js/Express ecosystems. Developers often accidentally expose the prisma/ folder in web directories during deployments or Docker builds. This template checks for the exposure of the schema.prisma file, which typically...

qdPM 9.2 - DB Credentials Exposure Detection

qdPM 9.2 database credentials were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """qdPM 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'qdPM 9.2 - DB Credentials Exposure Detection', 'description': 'qdPM...

Ruby on Rails Database Configuration File - Detect

Ruby on Rails database configuration file was detected, which may contain database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails database configuration file was detected, which may contain database credentials.""" from kittysploit import from lib.protocols.http.httpclien...

Seeyon OA A6 createMysql.jsp Database - Information Disclosure Detection

Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL. !/usr/bin/env python3 -- coding: utf-8 -- """Seeyon OA A6 has leaked sensitive database information.""" import re from kittysploit import from...

SQLite History - Exposure Detection

Detects exposed .sqlitehistory files. These files contain SQLite command history, including executed queries, table names, and potentially sensitive data that was queried or inserted. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed .""" import re from kittysploit import from...

OA E-Office mysql_config.ini - Information Disclosure Detection

E-Office mysqlconfig.ini file can be directly accessed, leaking database account password and other information !/usr/bin/env python3 -- coding: utf-8 -- """E-Office mysqlconfig.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion Detection

WordPress Advanced Access Manager versions before 5.9.9 are vulnerable to local file inclusion and allows attackers to download the wp-config.php file and get access to the database, which is publicly reachable on many servers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Acces...

Attu - Detect

Attu was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Attu was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Attu - Detect', 'description': 'Attu was detected.', 'author': 'KittySploit Team',...

Arcade.php - SQL Injection Detection

The arcade.php script is vulnerable to SQL injection. By exploiting this vulnerability, an attacker can manipulate the SQL queries executed by the script, potentially gaining unauthorized access to the database. !/usr/bin/env python3 -- coding: utf-8 -- """The arcade.""" from kittysploit import...

Batflat SQLite Database - Exposure Detection

Detected exposed Batflat CMS SQLite database files that may contain sensitive information including admin credentials, user data, site configuration, and content. Batflat stores its database in the /inc/data/ directory by default. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed...

Icinga Web 2 - Arbitrary File Disclosure Detection

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. !/usr/bin/env python3 --...

Dolibarr Unauthenticated Contacts Database Theft Detection

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in Dolibarr 16 before 16.""...

Vehicle Parking Management System 1.0 - SQL Injection Detection

Vehicle Parking Management System 1.0 contains a SQL injection vulnerability via the password parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python...