Weaviate Console - Detect

Detected Weaviate Console interface. Weaviate was open-source vector database that stores data objects and vector embeddings for AI applications. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weaviate Console interface.""" from kittysploit import from lib.protocols.http.httpclient import...

Joomla MarvikShop ShoppingCart 3.4 - Sql Injection Detection

Joomla MarvikShop ShoppingCart 3.4 is vulnerable to SQL injection which is a code injection technique that might destroy your database. SQL injection is one of the most common web hacking techniques. SQL injection is the placement of malicious code in SQL statements, via web page input...

Icinga Web 2 - Arbitrary File Disclosure Detection

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. !/usr/bin/env python3 --...

Dolibarr Unauthenticated Contacts Database Theft Detection

An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in Dolibarr 16 before 16.""...

XWiki < 4.10.20 - Remote code execution Detection

XWiki Platform is a generic wiki platform. Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. This allows remote code execution for any visitor of a public wiki or user of a close...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

Nacos <1.4.1 - Authentication Bypass Detection

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

Magento Mass Importer <0.7.24 - Remote Auth Bypass Detection

Magento Mass Importer aka MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. !/usr/bin/env python3 -- coding: utf-8 -- """Magento Mass Importer aka MAGMI versions prior to 0."""...

WhoDB < 0.45.0 - Path Traversal Detection

WhoDB contains a path traversal caused by lack of validation when opening database files, letting unauthenticated attackers access arbitrary Sqlite3 databases on the host system, exploit requires attacker to manipulate database filename input. !/usr/bin/env python3 -- coding: utf-8 -- """WhoDB...

Database Error Detection

Detects Database Error. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Database Error.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Database Error Detection', 'description': 'Detects Database Error.',...

Drupal - Source Code Disclosure Detection

Detected exposed Drupal source code, backup files, and sensitive configurations, potentially disclosing database credentials and API keys. This exposure revealed internal system paths and critical site metadata, increasing the risk of full system compromise. !/usr/bin/env python3 -- coding: utf-8...

Ecology - Information Exposure Detection

The "ecology" component exposes a file that contains sensitive database credentials dbuser/dbpass. !/usr/bin/env python3 -- coding: utf-8 -- """The "ecology" component exposes a file that contains sensitive database credentials dbuser/dbpass.""" from kittysploit import from...

Bigant DataBase - Exposed Installation Detection

Bigant DataBase Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Bigant DataBase Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Seeyon OA A6 createMysql.jsp Database - Information Disclosure Detection

Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL. !/usr/bin/env python3 -- coding: utf-8 -- """Seeyon OA A6 has leaked sensitive database information.""" import re from kittysploit import from...

ThinkPHP 5.0.9 - Information Disclosure Detection

ThinkPHP 5.0.9 includes verbose SQL error message that can reveal sensitive information including database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

PbootCMS 2.0.7 - SQL Injection Detection

PbootCMS 2.0.7 contains a SQL injection vulnerability via pbootcms.db. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """PbootCMS...

Hongfan OA udfmr.asmx - SQL injection Detection

There is a SQL injection vulnerability in Hongfan iOffice 10 Hospital Edition, which can be exploited by attackers to obtain sensitive database information. !/usr/bin/env python3 -- coding: utf-8 -- """There is a SQL injection vulnerability in Hongfan iOffice 10 Hospital Edition, which can be...

Joomla! Database File List Detection

A Joomla! database directory /libraries/joomla/database/ was found exposed and has directory indexing enabled. !/usr/bin/env python3 -- coding: utf-8 -- """A Joomla! database directory /libraries/joomla/database/ was found exposed and has directory indexing enabled.""" from kittysploit import fro...

Jakefile Build Configuration - Disclosure Detection

Detected Jakefile build configuration was found to be exposed, potentially having contained sensitive information including database credentials, API keys, and server configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Jakefile build configuration was found to be exposed,...

OpenCart Error Log Disclosure Detection

Detected exposed OpenCart error log files that may contain sensitive information including file paths, database errors, PHP warnings, and internal application details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed OpenCart error log files that may contain sensitive information...