Jolokia <= 1.7.1 Information Leakage Detection

Tomcat's credential disclosure leading to Remote Code Execution via WAR upload. !/usr/bin/env python3 -- coding: utf-8 -- """Tomcat's credential disclosure leading to Remote Code Execution via WAR upload.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

IoTaWatt Configuration App Exposure Detection

An IoTaWatt configuration app was discovered. Unauthenticated access to an IoTaWatt energy monitor could give a malicious attacker the means to upload to any of several third-party energy websites/database. !/usr/bin/env python3 -- coding: utf-8 -- """An IoTaWatt configuration app was...

KCFinder - Exposure Detection

Detected publicly accessible KCFinder instances that may have allowed arbitrary file uploads and remote code execution RCE.Exposure of KCFinder could have allowed an attacker to gain unauthorized access to the file manager and upload malicious files. !/usr/bin/env python3 -- coding: utf-8 --...

Unauthenticated Popup File Upload - Detect

Endpoints where files can be uploaded without authentication were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Endpoints where files can be uploaded without authentication were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

dash-uploader 0.1.0 - 0.7.0a2 - Denial-of-Service via flowTotalChunks Detection

fohrloop dash-uploader v0.1.0 through v0.7.0a2 contains a remote code execution caused by improper handling in Upload function and maxfilesize parameter in dashuploader components, letting remote attackers execute arbitrary code, exploit requires crafted request. !/usr/bin/env python3 -- coding:...

Cherry Plugin < 1.2.7 - Arbitrary File Retrieval and File Upload Detection

WordPress plugin Cherry 1.2.7 contains an unauthenticated file upload and download vulnerability, allowing attackers to upload and download arbitrary files. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file. !/usr/bin/env python3 -- coding: utf-8...

WordPress Cherry < 1.2.7 - Unauthenticated Arbitrary File Upload and Download Detection

WordPress plugin Cherry 1.2.7 has a vulnerability which enables an attacker to upload files directly to the server. This could result in attacker uploading backdoor shell scripts or downloading the wp-config.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin Cherry 1.""" from...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

DNN - Unrestricted Arbitrary File Upload

DNN 10.1.1 allows unauthenticated uploads via HtmlEditorProviders FileUploader.ashx. !/usr/bin/env python3 -- coding: utf-8 -- """DNN - Unrestricted Arbitrary File Upload""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

CX Cloud Unauthenticated Upload - Detect

CX Cloud unauthenticated upload was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CX Cloud unauthenticated upload was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CX Cloud Unauthenticated Upload...

Yonyou UFIDA NC - Information Exposure Detection

After logging in and visiting the address where the information was leaked, you will have permission to upload files. Then just go back to the homepage and view the published content directly. !/usr/bin/env python3 -- coding: utf-8 -- """After logging in and visiting the address where the...

CKFinder - Unauthenticated Exposure Detection

The CKFinder file manager was found to be exposed without authentication, allowing unauthenticated users to directly access its web interface. Due to this misconfiguration, attackers were able to browse server directories, upload arbitrary files, and manage existing files. !/usr/bin/env python3 -...

Label Studio < 1.18.0 - Reflected XSS Detection

Label Studio 1.18.0 contains a stored XSS caused by improper sanitization in POST /projects/upload-example/ endpoint, letting attackers inject malicious scripts to hijack sessions and perform unauthorized actions, exploit requires sending crafted requests. !/usr/bin/env python3 -- coding: utf-8 -...

Zimbra Collaboration - Unrestricted File Upload Detection

An issue was discovered in Zimbra Collaboration ZCS 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole extraction to /opt/zimbra/jetty/webapps/zimbra/public that can lead to incorrect access to any other user accounts. Zimbra recommends pax over cpio. Also,...

CVE-2026-15012 Demi <= 0.0.8 - Unauthenticated Information Exposure to Arbitrary Directory Copy

The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...

CVE-2026-66063: Improper Limitation of a Pathname to a Restricted Directory

goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.5, the httpserver/updown.go multipart upload handler split part.FileName on / but did not reject .., allowing an unauthenticated upload with filename .. to create a file outside the served tree. This...

CVE-2026-54593: Improper Restriction of Security Token Assignment

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained serveruuid, useruuid, and uniqueid claims without checking the token's intended purpose;...

PT-2026-65625

Name of the Vulnerable Software and Affected Versions goshs versions prior to 2.1.5 Description The multipart upload handler in the httpserver/updown.go file splits the part.FileName on the path separator but fails to reject the .. sequence. This allows an unauthenticated user to upload a file wi...

PT-2026-65514

Name of the Vulnerable Software and Affected Versions Pterodactyl Panel versions prior to 1.12.3 Pterodactyl Wings versions prior to 1.12.2 Description A privilege escalation issue exists in the Wings '/upload/file' endpoint. The system accepts any valid panel-signed JSON Web Token JWT containing...

Malicious code in @refactco/refact-os (npm)

Source: amazon-inspector 072881a1fd9241acfcd601ad5387b0338a26ff4828763658c3840b43a3cedb1c Running this package's refact-os init CLI scaffolds AI-editor hook configurations .claude/settings.json, .cursor/hooks.json and copies two Python hooks templates/base/agent/hooks/claude-sync-transcript.py,...