ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure Detection

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

SV3C HD Camera L Series - Open Redirect Detection

SV3C HD Camera L Series 2.3.4.2103-S50-NTD-B20170508B and 2.3.4.2103-S50-NTD-B20170823B contains an open redirect vulnerability. It does not perform origin checks on URLs in the camera's web interface, which can be leveraged to send a user to an unexpected endpoint. An attacker can possibly obtai...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

Adiscon LogAnalyzer - Information Disclosure Detection

Adiscon LogAnalyzer was discovered. Adiscon LogAnalyzer is a web interface to syslog and other network event data. It provides easy browsing and analysis of real-time network events and reporting services. !/usr/bin/env python3 -- coding: utf-8 -- """Adiscon LogAnalyzer was discovered.""" from...

AnythingLLM Panel Detection

Detects AnythingLLM personal LLM web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AnythingLLM panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AnythingLLM Panel Detection", "description":...

Allied Telesis AT-GS950/8 - Local File Inclusion Detection

Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 is susceptible to local file inclusion via its web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Allied Telesis AT-GS950/8 until Firmware AT-S107 V.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Copyparty v1.8.6 - Cross-Site Scripting Detection

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack. The vulnerability in the application's web interface could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. !/usr/bin/e...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal Detection

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 !/usr/bin/env python3 -- coding:...

Buffalo WSR-2533DHPL2 - Path Traversal Detection

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

Powertek Firmware <3.30.30 - Authorization Bypass Detection

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

Echelon i.LON SmartServer - Login Panel Detection

Echelon now Adesto/Dialog Semiconductor i.LON SmartServer is a LonWorks/IP-852 building automation controller used in HVAC, lighting, and energy management systems. The embedded web interface is frequently exposed on standard and non-standard ports. !/usr/bin/env python3 -- coding: utf-8 --...

EVSE Web Interface Panel - Detection

Detects EVSE Web Interface Panel - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EVSE Web Interface Panel - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EVSE Web Interface Panel -...

CopyParty v1.8.6 - Cross Site Scripting Detection

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

D-Link DIR-868L/817LW - Information Disclosure Detection

D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers are vulnerable to information disclosure vulnerabilities because certain web interfaces do not require authentication. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in...

Aquatronica Controller System <= 5.1.6 - Information Disclosure Detection

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

Westermo Industrial Router - Login Panel Detection

Westermo industrial router web interface panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Westermo industrial router web interface panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OpenCode Web - Unauthenticated Access Detection

Unauthenticated network access to the OpenCode web interface was detected. When the OpenCode web server is started without setting the OPENCODESERVERPASSWORD environment variable, the server is completely unsecured. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated network access to th...

SABnzbd - Unauthenticated Web Interface Access Detection

Detected SABnzbd found with the web interface accessible without authentication. The config page is exposed without login, leaking the API key, config file path, server parameters, and system information to unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SABnzbd found...