Odoo OpenERP Database Selector Panel - Detect

Odoo OpenERP database selector panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Odoo OpenERP database selector panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Odoo OpenERP Database...

PostgreSQL Credentials - Exposure Detection

Detects the exposure of PostgreSQL credentials and history files .pgpass via HTTP. These files may contain plaintext database usernames and passwords, and their leakage could allow unauthorized access to sensitive databases or internal infrastructure. !/usr/bin/env python3 -- coding: utf-8 --...

IoTaWatt Configuration App Exposure Detection

An IoTaWatt configuration app was discovered. Unauthenticated access to an IoTaWatt energy monitor could give a malicious attacker the means to upload to any of several third-party energy websites/database. !/usr/bin/env python3 -- coding: utf-8 -- """An IoTaWatt configuration app was...

Kanboard - SQLite Database Exposure Detection

Detected Kanboard SQLite database file was found to be exposed, containing sensitive information including user credentials, project data, tasks, and comments. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Kanboard SQLite database file was found to be exposed, containing sensitive...

Milvus - Detect

Milvus was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Milvus was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Milvus - Detect', 'description': 'Milvus was detected.', 'author': 'KittySploit...

Ruby on Rails Database Configuration File - Detect

Ruby on Rails database configuration file was detected, which may contain database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails database configuration file was detected, which may contain database credentials.""" from kittysploit import from lib.protocols.http.httpclien...

Tongda OA v11.6 report_bi.func.php - SQL injection Detection

Tongda OA v11.6 reportbi.func.php has a SQL injection vulnerability, and attackers can obtain database information through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tongda OA v11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Odoo - Unprotected Database Detection

The system has an Odoo application whose database manager is unprotected, indicating potential unauthorized access. !/usr/bin/env python3 -- coding: utf-8 -- """The system has an Odoo application whose database manager is unprotected, indicating potential unauthorized ac.""" from kittysploit impo...

DataEase <= 2.4.1 - Sensitive Information Exposure Detection

DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. Visiting the /de2api/engine/getEngine;.js path via a browser reveals that the platform's database configuration is returned. !/usr/bin/env python3...

DbGate Anonymous Access - Detection

Detected DbGate instances that allowed anonymous access due to insecure default authentication settings, where unauthenticated users could obtain a valid JWT token and access database management APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected DbGate instances that allowed anonymous...

Vehicle Parking Management System 1.0 - SQL Injection Detection

Vehicle Parking Management System 1.0 contains a SQL injection vulnerability via the password parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python...

WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion Detection

WordPress Advanced Access Manager versions before 5.9.9 are vulnerable to local file inclusion and allows attackers to download the wp-config.php file and get access to the database, which is publicly reachable on many servers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Acces...

Arcade.php - SQL Injection Detection

The arcade.php script is vulnerable to SQL injection. By exploiting this vulnerability, an attacker can manipulate the SQL queries executed by the script, potentially gaining unauthorized access to the database. !/usr/bin/env python3 -- coding: utf-8 -- """The arcade.""" from kittysploit import...

Batflat SQLite Database - Exposure Detection

Detected exposed Batflat CMS SQLite database files that may contain sensitive information including admin credentials, user data, site configuration, and content. Batflat stores its database in the /inc/data/ directory by default. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed...

WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection Detection

The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

AnythingLLM - Information Disclosure Detection

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticate...

Database Credentials File Exposure Detection

Internal file exposed containing database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Internal file exposed containing database credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Database...

SolarWinds Database Performance Analyzer 11.1.457 - Cross-Site Scripting Detection

SolarWinds Database Performance Analyzer 11.1.457 contains a reflected cross-site scripting vulnerability in its idcStateError component, where the page parameter is reflected into the HREF of the 'Try Again' Button on the page, aka a /iwc/idcStateError.iwc?page= URI. !/usr/bin/env python3 --...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

Bitrix Site Manager - Log File Disclosure Detection

Detected Bitrix Site Manager log files, potentially exposing sensitive information including database credentials, file paths, SQL queries, and user session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Bitrix Site Manager log files, potentially exposing sensitive information...