WP-CLI Yaml File Exposure Detection

Detects WP-CLI Yaml File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects WP-CLI Yaml File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WP-CLI Yaml File Exposure Detection', 'description':...

WP Smushit - Full Path Disclosure Detection

Smushit WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Smushit WordPress plugin contains ...

WordPress Plugin Imsanity - Full Path Disclosure Detection

WordPress Imsanity plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Imsanity plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress Contact Form 7 - Full Path Disclosure Detection

The WordPress Contact Form 7 plugin was detected to be vulnerable to Full Path Disclosure, where direct access to PHP files revealed the full server filesystem path and could aid further exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Contact Form 7 plugin was detected to...

WordPress WP Mail SMTP - Full Path Disclosure Detection

WordPress WP Mail SMTP plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP Mail SMTP plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Yarn Lock File Disclosure Detection

The yarn.lock file stores the versions of each Yarn dependency installed. It's a lock file for package.json. !/usr/bin/env python3 -- coding: utf-8 -- """The yarn.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Yarn...

elFinder <=2.1.60 - Local File Inclusion Detection

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. !/usr/bin/env python3 -- coding: utf-...

openSIS v9.0 - Path Traversal Detection

A path traversal vulnerability exists in openSIS Classic Community Edition v9.0 via the 'filename' parameter in DownloadWindow.php. An unauthenticated remote attacker can exploit this to read arbitrary files on the server by manipulating file paths. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Home Assistant HACS - Local File Inclusion Detection

Home Assistant before 2021.1.3 lacks a protection layer against directory-traversal attacks in custom integrations, letting attackers access arbitrary files, exploit requires attacker to deploy malicious custom integration. !/usr/bin/env python3 -- coding: utf-8 -- """Home Assistant before 2021."...

Joomla! Component JInventory 1.23.02 - Local File Inclusion Detection

A directory traversal vulnerability in jinventory.php in the JInventory comjinventory component 1.23.02 and possibly other versions before 1.26.03, a module for Joomla!, allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python...

Joomla! Component Sweetykeeper 1.5 - Local File Inclusion Detection

A directory traversal vulnerability in the Sweety Keeper comsweetykeeper component 1.5.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """...

MODx manager - Local File Inclusion Detection

A directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl and possibly earlier allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter when magicquotesgpc is disabled. !/usr/bin/env python3 -- coding: utf-8 -...

Osclass Security Advisory 3.4.1 - Local File Inclusion Detection

A directory traversal vulnerability in OSClass before 3.4.2 allows remote attackers to read arbitrary files via a .. dot dot in the file parameter in a render action to oc-admin/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in OSClass before 3."""...

XWiki Platform - Path Traversal Detection

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform 4.""" from...

Joomla! Component Realtyna Translator 1.0.15 - Local File Inclusion Detection

A directory traversal vulnerability in the Realtyna Translator comrealtyna component 1.0.15 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 --...

Joomla! Component SVMap 1.1.1 - Local File Inclusion Detection

A directory traversal vulnerability in the SVMap comsvmap component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the SVMap comsvmap...

Fortinet FortiOS - Credentials Disclosure Detection

Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.3 to 5.6.7 and 5.4.6 to 5.4.12 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1.1.0 to 1.1.6, 1.0.0 to 1.0.7 under SSL VPN web portal allows an unauthenticated attacker to download system files via special crafted HTTP resource requests due to improper limitation of a...

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion Detection

Razer Sila Gaming Router 2.0.441api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Razer Sila Gaming Router 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Exposed JSON Configuration Files Detection

Detects exposed JSON configuration files containing sensitive information including API keys, access tokens, AWS credentials, database configurations, base URLs, file paths, and application settings. These files often contain production configurations and credentials that should not be publicly...

Joomla! Component com_janews - Local File Inclusion Detection

A directory traversal vulnerability in the JA News comjanews component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the JA News...