Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection Detection

Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...

Linear eMerge E3-Series - Information Disclosure Detection

Linear eMerge E3-Series devices are susceptible to information disclosure. Admin credentials are stored in clear text at the endpoint /test.txt in situations where the default admin credentials have been changed. An attacker can obtain admin credentials, access the admin dashboard, control buildi...

Jira Netic Group Export <1.0.3 - Missing Authorization Detection

Jira Netic Group Export add-on before 1.0.3 contains a missing authorization vulnerability. The add-on does not perform authorization checks, which can allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a...

Openfire Administration Console - Authentication Bypass Detection

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

PMB 7.4.6 - Cross-Site Scripting Detection

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

Wavlink - Improper Access Control Detection

Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Admin Word Count Column 2.2 - Local File Inclusion Detection

The plugin does not validate the path parameter given to readfile, which could allow unauthenticated attackers to read arbitrary files on server running old version of PHP susceptible to the null byte technique. This could also lead to RCE by using a Phar Deserialization technique. !/usr/bin/env...

WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure Detection

The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request !/usr/bin/env python3 -- coding: utf-8 -- """The HC Custom WP-Admin URL WordPress plugin through 1.""" import re from kittysploit import from lib.protocols.http.httpclient...

TBK DVR4104/DVR4216 Devices - Authentication Bypass Detection

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

TeamCity < 2023.11.4 - Authentication Bypass Detection

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible !/usr/bin/env python3 -- coding: utf-8 -- """In JetBrains TeamCity before 2023.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

TeamCity < 2023.11.4 - Authentication Bypass Detection

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible !/usr/bin/env python3 -- coding: utf-8 -- """In JetBrains TeamCity before 2023.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

Dgraph <= 25.3.2 - Admin Token Disclosure Detection

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

Python Django Admin Login Panel - Detect

Python Django admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Python Django admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Python Django Admin Login Panel...

Envoy Admin Exposure Detection

Envoy Admin page exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Envoy Admin page exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Envoy Admin Exposure Detection', 'description': 'Envoy Admin page...

FatPipe MPVPN - Panel Detect

The admin panel of the FatPipe MPVPN has been discovered. !/usr/bin/env python3 -- coding: utf-8 -- """The admin panel of the FatPipe MPVPN has been discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FatPipe...

Gargoyle Router Management Utility Admin Login Panel - Detect

Gargoyle Router Management Utility admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gargoyle Router Management Utility admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Grails Admin Console Panel - Detect

Grails Admin Console panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Grails Admin Console panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Grails Admin Console Panel - Detect',...

Grav Register Admin User - Detect

Exposed Grav admin user register page. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Grav admin user register page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Grav Register Admin User - Detect',...