Weaviate Console - Detect

Detected Weaviate Console interface. Weaviate was open-source vector database that stores data objects and vector embeddings for AI applications. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weaviate Console interface.""" from kittysploit import from lib.protocols.http.httpclient import...

Symfony Database Configuration File - Detect

Symfony database configuration file was detected and may contain database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Symfony database configuration file was detected and may contain database credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

ThinkPHP 5.0.9 - Information Disclosure Detection

ThinkPHP 5.0.9 includes verbose SQL error message that can reveal sensitive information including database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Tongda OA v11.6 report_bi.func.php - SQL injection Detection

Tongda OA v11.6 reportbi.func.php has a SQL injection vulnerability, and attackers can obtain database information through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tongda OA v11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress DB Backup Detection

This template checks for exposed database in wordpress. !/usr/bin/env python3 -- coding: utf-8 -- """This template checks for exposed database in wordpress.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress D...

Ecology - Information Exposure Detection

The "ecology" component exposes a file that contains sensitive database credentials dbuser/dbpass. !/usr/bin/env python3 -- coding: utf-8 -- """The "ecology" component exposes a file that contains sensitive database credentials dbuser/dbpass.""" from kittysploit import from...

Database Credentials File Exposure Detection

Internal file exposed containing database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Internal file exposed containing database credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Database...

UFIDA U8 CRM cfillbacksetting.php - SQL Injection Detection

UFIDA U8-CRM system /config/fillbacksetting.php contains an SQL injection vulnerability, which allows attackers to manipulate the database through maliciously constructed SQL statements, resulting in data leaks, tampering or destruction, and seriously threatening system security. !/usr/bin/env...

IoTaWatt Configuration App Exposure Detection

An IoTaWatt configuration app was discovered. Unauthenticated access to an IoTaWatt energy monitor could give a malicious attacker the means to upload to any of several third-party energy websites/database. !/usr/bin/env python3 -- coding: utf-8 -- """An IoTaWatt configuration app was...

ITFlow Unfinished Installation Detection

Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configure the database and create an admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configur...

Joomla! Database File List Detection

A Joomla! database directory /libraries/joomla/database/ was found exposed and has directory indexing enabled. !/usr/bin/env python3 -- coding: utf-8 -- """A Joomla! database directory /libraries/joomla/database/ was found exposed and has directory indexing enabled.""" from kittysploit import fro...

Marqo Vector Search Engine - Detect

Marqo vector search engine was detected. Marqo is an open-source tensor search and vector database that combines vector search with filtering and text/image search for AI applications. !/usr/bin/env python3 -- coding: utf-8 -- """Marqo vector search engine was detected.""" from kittysploit import...

WordPress Google Maps <7.11.18 - SQL Injection Detection

WordPress Google Maps plugin before 7.11.18 contains a SQL injection vulnerability. The plugin includes /class.rest-api.php in the REST API and does not sanitize field names before a SELECT statement. An attacker can possibly obtain sensitive information from a database, modify data, and execute...

Magento Mass Importer <0.7.24 - Remote Auth Bypass Detection

Magento Mass Importer aka MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. !/usr/bin/env python3 -- coding: utf-8 -- """Magento Mass Importer aka MAGMI versions prior to 0."""...

Jakefile Build Configuration - Disclosure Detection

Detected Jakefile build configuration was found to be exposed, potentially having contained sensitive information including database credentials, API keys, and server configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Jakefile build configuration was found to be exposed,...

Joomla MarvikShop ShoppingCart 3.4 - Sql Injection Detection

Joomla MarvikShop ShoppingCart 3.4 is vulnerable to SQL injection which is a code injection technique that might destroy your database. SQL injection is one of the most common web hacking techniques. SQL injection is the placement of malicious code in SQL statements, via web page input...

Kanboard - SQLite Database Exposure Detection

Detected Kanboard SQLite database file was found to be exposed, containing sensitive information including user credentials, project data, tasks, and comments. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Kanboard SQLite database file was found to be exposed, containing sensitive...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

AnythingLLM - Information Disclosure Detection

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticate...

Drupal - Source Code Disclosure Detection

Detected exposed Drupal source code, backup files, and sensitive configurations, potentially disclosing database credentials and API keys. This exposure revealed internal system paths and critical site metadata, increasing the risk of full system compromise. !/usr/bin/env python3 -- coding: utf-8...