CVE-2026-20294: Cleartext Transmission of Sensitive Information

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to view sensitive information in clear text on an affected system. This vulnerability is due to insufficient access control enforcement for specific template types...

CVE-2026-20288: Improper Neutralization of Expression/Command Delimiters

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with Admin privileges to execute arbitrary commands on the underlying operating system of an affected system and elevate privileges to root. This vulnerability is due to improper...

PT-2026-68249

Name of the Vulnerable Software and Affected Versions Cisco IOS XE Software affected versions not specified Description Insufficient error handling in the web-based management interface allows an authenticated remote attacker with low privileges to trigger a denial of service DoS condition. The...

Cisco Secure FMC Privilege Escalation

The vulnerability in the web-based authentication interface of the Cisco Secure FMC Software for managing network security devices is related to the use of strictly encrypted login credentials. Exploiting this vulnerability can allow a malicious actor to remotely increase their privileges...

SUSE CVE-2026-46410

FileBrowser Quantum is a free, self-hosted, web-based file manager. Versions prior to 1.3.2-stable and 1.4.1-beta may leak some sensitive info, such as source and path. Versions 1.3.2-stable and 1.4.1-beta fix the issue. No known workarounds are available...

Auerswald COMfortel 1400/2600/3600 IP - Authentication Bypass Detection

Auerswald COMfortel 1400/2600/3600 IP is susceptible to an authentication bypass vulnerability. Inserting the prefix "/about/../" allows bypassing the authentication check for the web-based configuration management interface. This enables attackers to gain access to the login credentials used for...

JK Status Manager - Detect

Exposed JKStatus manager which is a web-based tool that allows administrators to monitor and manage the connections between the Apache HTTP Server and the Tomcat application server. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed JKStatus manager which is a web-based tool that allows...

Monsta FTP - Detect

Detects Monsta FTP web-based file manager interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Monsta FTP web-based file manager interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Monsta FTP -...

WAGO Web based Management - Default Login Detection

Identified WAGO Web-Based Management interfaces that were accessible using default credentials admin:wago.These interfaces are used to configure and monitor WAGO programmable logic controllers PLCs and automation systems. Use of factory-default credentials exposed critical OT infrastructure to...

NI Web-based Configuration & Monitoring - Detect

Detects NI Web-based Configuration & Monitoring - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects NI Web-based Configuration & Monitoring - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NI...

OpenClaw Control - Detect

Detected OpenClaw Control, a web-based control interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detected OpenClaw Control, a web-based control interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenCla...

CODESYS WebVisu - Panel Detection

CODESYS WebVisu is the web-based HMI Human-Machine Interface component of the CODESYS industrial automation runtime. It provides browser-based access to PLC visualizations and industrial control interfaces. Exposed instances may reveal real-time process data and control functions without...

Cisco RV110W RV130W RV215W Router - Information leakage Detection

A vulnerability in the web-based management interface of Cisco RV110W, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to access the syslog file on an affected device. The vulnerability is due to improper authorization of an HTTP request. An attacker could exploit this...

Cisco HyperFlex HX Data Platform - Arbitrary File Upload Detection

Cisco HyperFlex HX Data Platform contains an arbitrary file upload vulnerability in the web-based management interface. An attacker can send a specific HTTP request to an affected device, thus enabling upload of files to the affected device with the permissions of the tomcat8 user. !/usr/bin/env...

AIX WebSM - Detect

Detects IBM AIX Web-based System Manager services. !/usr/bin/env python3 -- coding: utf-8 -- """Detects IBM AIX Web-based System Manager services.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info =...

Apache ActiveMQ <=5.15.5 - Cross-Site Scripting Detection

Apache ActiveMQ versions 5.0.0 to 5.15.5 are vulnerable to cross-site scripting via the web based administration console on the queue.jsp page. The root cause of this issue is improper data filtering of the QueueFilter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Apache ActiveMQ versio...

Openfire Administration Console - Authentication Bypass

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

EUVD-2026-47285

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft component: eProcurement. The supported version that is affected is 9.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft...

CVE-2026-8699: Improper Neutralization of Input During Web Page Generation

A stored Cross-Site Scripting XSS vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privilege...

PT-2026-52900

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 17.3.2 OpenProject versions prior to 17.4.0 Description The meetings filter feature in the web application allows an attacker to enumerate existing user accounts by probing user IDs and observing differences in...