Rasa Open Source - Detect

Rasa Open Source, an open-source conversational AI framework used to build chatbots and voice assistants that exposes a REST server default port 5005 for intent parsing and webhook-driven conversations, was detected. Exposed unauthenticated instances may have allowed interaction with the...

SonarQube - Information Disclosure Detection

Information leakage vulnerability in an interface of SonarQube, you can download the source code through the tool. !/usr/bin/env python3 -- coding: utf-8 -- """Information leakage vulnerability in an interface of SonarQube, you can download the source code through the t.""" from kittysploit impor...

React / Vite Dev Server Exposure Detection

Detects development-mode React tooling left reachable Vite client, React Refresh, webpack HMR / sockjs which often leaks source and enables SSRF. !/usr/bin/env python3 -- coding: utf-8 -- """Detect React/Vite/webpack development servers exposed to the network.""" from kittysploit import from...

WordPress Data Source for Contact Form 7 - Full Path Disclosure Detection

WordPress Plugin CData Source for Contact Form 7 files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CData Source for Contact Form 7...

WP Smushit - Full Path Disclosure Detection

Smushit WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Smushit WordPress plugin contains ...

Remita Merchant ID & API Key - Exposure Detection

Detected exposed Remita merchant IDs, API keys, and secret hashes in application source code, configuration files, or publicly accessible assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Remita merchant IDs, API keys, and secret hashes in application source code, configuratio...

WordPress WPS Hide Login - Error Log Disclosure Detection

Detected whether the WPS Hide Login plugin’s /classes/ directory was exposed with directory listing enabled due to server misconfiguration, potentially disclosing PHP error logs or source code. !/usr/bin/env python3 -- coding: utf-8 -- """Detected whether the WPS Hide Login plugin’s /classes/...

Microsoft SharePoint - Remote Code Execution Detection

Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source markup of an application package. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft SharePoint is vulnerable to a remote code execution when the software fails to check the source mark."...

Intelbras WIN 300/WRN 342 - Credentials Disclosure Detection

Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the defwirelesspassword line in the HTML source code. !/usr/bin/env python3 -- coding: utf-8 -- """Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers t...

Rstudio Shiny Server <1.5.16 - Local File Inclusion Detection

Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Rstudio Shiny Server prior to 1.""" import re from kittysploit import from...

Vugex Framework Source Code - Detect

Detects the presence of exposed Vugex Framework source code by identifying common files and directories associated with the framework. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of exposed Vugex Framework source code by identifying common files and directories associ."""...

WAVLINK WN530HG4 - Improper Access Control Detection

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd and thereby possibly obtain sensitive information, modify data, and/or execute...

Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion Detection

The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the executio...

Drupal - Source Code Disclosure Detection

Detected exposed Drupal source code, backup files, and sensitive configurations, potentially disclosing database credentials and API keys. This exposure revealed internal system paths and critical site metadata, increasing the risk of full system compromise. !/usr/bin/env python3 -- coding: utf-8...

Airbyte Panel Detection

Detects Airbyte open-source data integration panel and health API. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Airbyte data integration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Airbyte Panel...

Phalcon Framework - Source Code Leakage Detection

Phalcon Framework source code was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Phalcon Framework source code was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Phalcon Framework - Source Code...

IBM WebSphere Application - Source File Exposure Detection

Disclose application specific files contained within the war file, including files under the web-inf and meta-inf directories. !/usr/bin/env python3 -- coding: utf-8 -- """Disclose application specific files contained within the war file, including files under the web-inf and meta-.""" from...

Astro - Information Disclosure Detection

Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enable...

.gitmodules File Exposed Detection

The .gitmodules file was exposed on the web server as part of an accessible .git directory.This exposure indicated a misconfiguration that could have allowed attackers to explore the .git directory further and potentially reconstruct or download the full source code repository. !/usr/bin/env...

Vercel Source Code Exposure Detection

The Vercel Source Code Exposure misconfiguration allows an attacker to access sensitive source code files on the Vercel platform. !/usr/bin/env python3 -- coding: utf-8 -- """The Vercel Source Code Exposure misconfiguration allows an attacker to access sensitive source code files on t.""" from...