Webp Server Go - Path Traversal Detection

Webp Server Go has an Path Traversal vulnerability. Attackers can use the vulnerability to access arbitraty file. !/usr/bin/env python3 -- coding: utf-8 -- """Webp Server Go has an Path Traversal vulnerability.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Count Per Day <= 3.1 - download.php f Parameter Traversal Arbitrary File Access Detection

An absolute path traversal vulnerability in download.php in the Count Per Day module before 3.1.1 for WordPress allows remote attackers to read arbitrary files via the f parameter. !/usr/bin/env python3 -- coding: utf-8 -- """An absolute path traversal vulnerability in download.""" import re from...

Apache Cocoon 2.1.12 - XML Injection Detection

Apache Cocoon 2.1.12 is susceptible to XML injection. When using the StreamGenerator, the code parses a user-provided XML. A specially crafted XML, including external system entities, can be used to access any file on the server system. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Cocoon...

WordPress Simple Custom CSS Plugin - Full Path Disclosure Detection

Detected WordPress Simple Custom CSS plugin internal file system path was exposed through direct file access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected WordPress Simple Custom CSS plugin internal file system path was exposed through direct file access.""" from kittysploit import from...

WordPress Table of Contents Plus - Full Path Disclosure Detection

WordPress Table of Contents Plus plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Table of Contents Plus plugin is vulnerable to full path disclosure via direct access to plugin file.""" from kittysploit import...

WordPress The Events Calendar - Full Path Disclosure Detection

WordPress The Events Calendar plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress The Events Calendar plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress CMB2 - Full Path Disclosure Detection

WordPress CMB2 plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress CMB2 plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from lib.protocols.http.httpclient...

WordPress Custom Post Type UI - Full Path Disclosure Detection

Detected WordPress Custom Post Type UI exposes internal file system path through direct file access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected WordPress Custom Post Type UI exposes internal file system path through direct file access.""" from kittysploit import from...

WordPress WP Maintenance Mode - Full Path Disclosure Detection

WordPress WP Maintenance Mode plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP Maintenance Mode plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress Members / Membership & User Role Editor Plugin - Error Log Disclosure Detection

WordPress Members plugin is vulnerable to error log disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Members plugin is vulnerable to error log disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress YITH WooCommerce Wishlist - Full Path Disclosure Detection

WordPress YITH WooCommerce Wishlist plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress YITH WooCommerce Wishlist plugin is vulnerable to full path disclosure via direct access to plugin f.""" from kittysploit impo...

Copyparty <= 1.8.2 - Directory Traversal Detection

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This...

Oracle eBusiness Suite - Improper File Access Detection

Oracle eBusiness Suite is susceptible to improper file access vulnerabilities via bispgrapgh. Be aware this product is no longer supported with patches or security fixes. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle eBusiness Suite is susceptible to improper file access vulnerabilities via...

Magento Downloader - Full Path Disclosure Detection

Detected Magento Downloader component exposed internal file system paths through direct file access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Magento Downloader component exposed internal file system paths through direct file access.""" from kittysploit import from...

n8n Webhooks - Remote Code Execution Detection

n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker,...

Blinko <= 1.8.3 - Path Traversal via /plugins Detection

Blinko = 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access. !/usr/bin/env python3 -- coding: utf-8 -- """Blinko = 1.""" import re from...

Ivanti Avalanche 6.3.2 - Local File Inclusion Detection

Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Avalanche 6.""" from kittysploit import from lib.protocols.http.httpclient import...

TermTalk Server 3.24.0.2 - Local File Inclusion Detection

TermTalk Server TTServer 3.24.0.2 is vulnerable to file inclusion which allows unauthenticated malicious user to gain access to the files on the remote system by providing the relative path of the file they want to retrieve. !/usr/bin/env python3 -- coding: utf-8 -- """TermTalk Server TTServer...

BOA Web Server 0.94.14 - Arbitrary File Access Detection

BOA Web Server 0.94.14 is susceptible to arbitrary file access. The server allows the injection of "../.." using the FILECAMERA variable sent by GET to read files with root privileges and without using access credentials. !/usr/bin/env python3 -- coding: utf-8 -- """BOA Web Server 0.""" import re...

WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access Detection

WordPress Welcart e-Commerce plugin before 2.8.5 is susceptible to arbitrary file access. The plugin does not validate user input before using it to output the content of a file, which can allow an attacker to read arbitrary files on the server, obtain sensitive information, modify data, and/or...