Raritan PDU - Login Panel Detection

Raritan intelligent PDU web interface panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Raritan intelligent PDU web interface panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

SABnzbd - Unauthenticated Web Interface Access Detection

Detected SABnzbd found with the web interface accessible without authentication. The config page is exposed without login, leaking the API key, config file path, server parameters, and system information to unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SABnzbd found...

SAPControl Webmethods - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the GetInstanceProperties method without requiring authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface...

Echelon i.LON SmartServer - Login Panel Detection

Echelon now Adesto/Dialog Semiconductor i.LON SmartServer is a LonWorks/IP-852 building automation controller used in HVAC, lighting, and energy management systems. The embedded web interface is frequently exposed on standard and non-standard ports. !/usr/bin/env python3 -- coding: utf-8 --...

XPhone Connect Admin Interface - Detect

Detects the presence of the XPhone Connect admin interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the XPhone Connect admin interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

KACE Systems Management Appliance - Installer Detection

The exposure of the KACE Systems Management Appliance’s installer interface through the /common/setup.php endpoint allowed unauthorized access to the system setup wizard. This interface was publicly accessible when it should have been restricted, potentially granting attackers the ability to...

TOTOLINK/Realtek Routers - Information Disclosure Detection

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

CopyParty v1.8.6 - Cross Site Scripting Detection

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link...

Progress Kemp LoadMaster - Command Injection Detection

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated remote attackers can access the system through the LoadMaster management interface, enablin...

Buffalo WSR-2533DHPL2 - Path Traversal Detection

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo...

Aquatronica Controller System <= 5.1.6 - Information Disclosure Detection

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

CVE-2026-63301

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

Vatican&#8217;s Click To Pray app exposed personal data from 700,000 users

A prayer app launched by Pope Francis in 2019 contained a security flaw that exposed the personal information of hundreds of thousands of users before it was finally fixed this year. The app, Click To Pray, was developed by La Machi Communication for Good Causes for the Pope's Worldwide Prayer...

CVE-2026-63301 Denial of Service in Quick.CMS

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

EUVD-2026-49754

In Quick.CMS, the administrative user interface restricts deletion of the primary language by omitting the corresponding option from the interface; however, the underlying language-deletion API endpoint does not enforce an equivalent server-side authorization check. As a result, an authenticated...

CVE-2026-63301

In Quick.CMS, the language-deletion API endpoint lacks server-side authorization, allowing an authenticated administrator to delete the primary language via a direct request and cause application DoS. When combined with CSRF (CVE-2026-1468), an unauthenticated attacker can craft a malicious link ...

CVE-2026-59764

ELECOM wireless LAN routers and access points devices contain an OS Command Injection vulnerability in WebUI. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product...

CVE-2026-14171

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

CVE-2026-14171 ads-tec Industrial IT: Post-login open redirect in the web interface

An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability...

CVE-2026-14171

CVE-2026-14171 affects ads-tec Industrial IT web UI via an unauthenticated remote attacker abusing improper validation of the post-login redirect. This open redirect could mislead users to a malicious site, with potential impacts to confidentiality and availability as described. Root cause: impro...