CVE-2026-15108

An integer overflow flaw was found in the Extensions API component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=515443146...

OLT Web Management Interface Login Panel - Detect

OLT Web Management Interface login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OLT Web Management Interface login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OLT Web...

OfficeWeb365 Indexs Interface - Arbitrary File Read Detection

There is any file reading in the officeWeb365 Indexs interface. !/usr/bin/env python3 -- coding: utf-8 -- """There is any file reading in the officeWeb365 Indexs interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Buffalo WSR-2533DHPL2 - Path Traversal Detection

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo...

Aquatronica Controller System <= 5.1.6 - Information Disclosure Detection

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

Powertek Firmware <3.30.30 - Authorization Bypass Detection

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

Allied Telesis AT-GS950/8 - Local File Inclusion Detection

Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 is susceptible to local file inclusion via its web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Allied Telesis AT-GS950/8 until Firmware AT-S107 V.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

Tieline IP Audio Gateway <=2.6.4.8 - Unauthorized Remote Admin Panel Access Detection

Tieline IP Audio Gateway 2.6.4.8 and below is affected by a vulnerability in the web administrative interface that could allow an unauthenticated user to access a sensitive part of the system with a high privileged account. !/usr/bin/env python3 -- coding: utf-8 -- """Tieline IP Audio Gateway 2."...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

N-able N-central < 2024.2 - Authentication Bypass Detection

N-central server versions prior to 2024.2 contain an authentication bypass in the user interface, letting attackers access restricted areas without proper credentials, exploit requires no specific conditions. !/usr/bin/env python3 -- coding: utf-8 -- """N-central server versions prior to 2024."""...

Adiscon LogAnalyzer - Information Disclosure Detection

Adiscon LogAnalyzer was discovered. Adiscon LogAnalyzer is a web interface to syslog and other network event data. It provides easy browsing and analysis of real-time network events and reporting services. !/usr/bin/env python3 -- coding: utf-8 -- """Adiscon LogAnalyzer was discovered.""" from...

AnythingLLM Panel Detection

Detects AnythingLLM personal LLM web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AnythingLLM panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AnythingLLM Panel Detection", "description":...

CradlePoint Gateway - Login Panel Detection

CradlePoint an Ericsson company produces cellular-connected SD-WAN and VPN gateway appliances. The web administration interface is commonly exposed on port 8080. !/usr/bin/env python3 -- coding: utf-8 -- """CradlePoint an Ericsson company produces cellular-connected SD-WAN and VPN gateway...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal Detection

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 !/usr/bin/env python3 -- coding:...

Bytebase Auth - Panel Detect

Bytebase authentication interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Bytebase authentication interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bytebase Auth - Panel...

OpenCode Web - Unauthenticated Access Detection

Unauthenticated network access to the OpenCode web interface was detected. When the OpenCode web server is started without setting the OPENCODESERVERPASSWORD environment variable, the server is completely unsecured. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated network access to th...

Westermo Industrial Router - Login Panel Detection

Westermo industrial router web interface panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Westermo industrial router web interface panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

HP LaserJet Configuration Exposure Detection

HP LaserJet printer web interface exposes sensitive configuration information without authentication.This includes device information, network configuration, SNMP settings, and other sensitive data that could be leveraged for further attacks or network reconnaissance. !/usr/bin/env python3 --...