Portainer - Init Deploy Discovery Detection

Portainer initialization deployment files were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Portainer initialization deployment files were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Generic PHP Backup Information Disclosure Detection

Generic php file source code was detected via backup files. !/usr/bin/env python3 -- coding: utf-8 -- """Generic php file source code was detected via backup files.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Ghost CMS < 5.42.1 - Path Traversal Detection

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js. !/usr/bin/env python3 -- coding: utf-8 -- """Ghost before 5.""" from kittysploit import...

Nodogsplash - Directory Traversal Detection

Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system. !/usr/bin/env python3 -...

Lawo AG vsm LTC Time Sync (vTimeSync) - Path Traversal Detection

The web server of Lawo AG vsm LTC Time Sync vTimeSync is affected by a "..." triple dot path traversal vulnerability. By sending a specially crafted HTTP request, an unauthenticated remote attacker could download arbitrary files from the operating system. As a limitation, the exploitation is only...

MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal Detection

MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 = Maintenance Pack 36 with Servicepack 8 week 36/2025 contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows ...

Zimbra - Cross-Site Scripting via ICS Files Detection

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

SonicWall SMA1000 LFI Detection

Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory. !/usr/bin/env python3 -- coding: utf-8 -- """Pre-authentication path traversal vulnerabilit...

PrestaShop TshirteCommerce - Directory Traversal Detection

The Custom Product Designer tshirtecommerce module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files. !/usr/bin/env python3 -- coding: utf-8 -- """The Custom...

Prime Mover < 1.9.3 - Sensitive Data Exposure Detection

Prime Mover plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.9.2 via directory listing in the 'prime-mover-export-files/1/' folder. This makes it possible for unauthenticated attackers to extract sensitive data including site and...

Magento Unprotected development files Detection

Magento version 1.9.2.x includes /dev directories or files that might reveal your passwords and other sensitive information. The /dev directories and files are not protected by default. According to Magento, "these tests are not supposed to end up on production servers". !/usr/bin/env python3 --...

PHP Proxy 3.0.3 - Local File Inclusion Detection

PHP Proxy 3.0.3 is susceptible to local file inclusion vulnerabilities that allow unauthenticated users to read files from the server via index.php?q=file:/// a different vulnerability than CVE-2018-19246. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Proxy 3.""" import re from kittysploit...

CKFinder - Unauthenticated Exposure Detection

The CKFinder file manager was found to be exposed without authentication, allowing unauthenticated users to directly access its web interface. Due to this misconfiguration, attackers were able to browse server directories, upload arbitrary files, and manage existing files. !/usr/bin/env python3 -...

BIQS IT Biqs-drive v1.83 Local File Inclusion Detection

A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user. !/usr/bin/env...

WordPress Nevma Adaptive Images <0.6.67 - Local File Inclusion Detection

WordPress Nevma Adaptive Images plugin before 0.6.67 allows remote attackers to retrieve arbitrary files via the $REQUEST'adaptive-images-settings''sourcefile' parameter in adaptive-images-script.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Nevma Adaptive Images plugin before 0."""...

Devika v1 - Path Traversal Detection

The snapshotpath parameter in the /api/get-browser-snapshot endpoint in stitionai devika v1 is susceptible to a path traversal attack. An attacker can manipulate the snapshotpath parameter to traverse directories and access sensitive files on the server. This can potentially lead to unauthorized...

Atlassian Confluence <5.8.17 - Information Disclosure Detection

Atlassian Confluence before 5.8.17 contains an information disclsoure vulnerability. A remote authenticated user can read configuration files via the decoratorName parameter to 1 spaces/viewdefaultdecorator.action or 2 admin/viewdefaultdecorator.action. !/usr/bin/env python3 -- coding: utf-8 --...

SAP xMII 15.0 for SAP NetWeaver 7.4 - Local File Inclusion Detection

SAP xMII 15.0 for SAP NetWeaver 7.4 is susceptible to a local file inclusion vulnerability in the GetFileList function. This can allow remote attackers to read arbitrary files via a .. dot dot in the path parameter to /Catalog, aka SAP Security Note 2230978. !/usr/bin/env python3 -- coding: utf-8...

Joomla! Harmis Messenger 1.2.2 - Local File Inclusion Detection

Joomla! Harmis Messenger 1.2.2 is vulnerable to local file inclusion which could give an attacker read access to arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla! Harmis Messenger 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...