PMB 7.4.6 - Cross-Site Scripting Detection

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

Openfire Administration Console - Authentication Bypass Detection

Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was found to be vulnerable to a path traversal attack via the setup environment. This permitted an unauthenticated user to use the unauthenticated Openfire Setup...

WOOF WordPress plugin - Cross-Site Scripting Detection

The WOOF WordPress plugin does not sanitize or escape the woofredrawelements parameter before reflecting it back in an admin page, leading to a reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """The WOOF WordPress plugin does not sanitize or escape the woofredrawelements...

WordPress HC Custom WP-Admin URL <=1.4 - Admin Login URL Disclosure Detection

The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request !/usr/bin/env python3 -- coding: utf-8 -- """The HC Custom WP-Admin URL WordPress plugin through 1.""" import re from kittysploit import from lib.protocols.http.httpclient...

Alt-n/MDaemon Security Gateway <=8.5.0 - XML Injection Detection

Alt-n/MDaemon Security Gateway through 8.5.0 is susceptible to XML injection via SecurityGateway.dll?view=login. An attacker can inject an arbitrary XML argument by adding a new parameter in the HTTP request URL. As a result, the XML parser fails the validation process and discloses information...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

Keycloak Admin Login Panel - Detect

Keycloak admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Keycloak admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Keycloak Admin Login Panel - Detect',...

Leantime - Unfinished Installation Detection

Detected a Leantime instance identified with the setup installation page accessible at /install, enabling unauthenticated users to create the first administrator account and configure the database. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a Leantime instance identified with the setup...

Lucy Security Admin Panel Detection

Detects Lucy Security Admin Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Lucy Security Admin Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lucy Security Admin Panel Detection', 'description':...

Micro Focus Enterprise Server Admin Panel - Detect

Micro Focus Enterprise Server Admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Micro Focus Enterprise Server Admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Micro Focus...

Netlify CMS Admin Login Panel - Detect

Netlify CMS admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Netlify CMS admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Netlify CMS Admin Login Panel -...

EkoAPI Admin Panel - Detect

EkoAPI Admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EkoAPI Admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EkoAPI Admin Panel - Detect', 'description': 'EkoAPI Admi...

Envoy Admin Exposure Detection

Envoy Admin page exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Envoy Admin page exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Envoy Admin Exposure Detection', 'description': 'Envoy Admin page...

GYRA Master Admin Login Panel - Detect

GYRA Master Admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GYRA Master Admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GYRA Master Admin Login Panel -...

Ilch CMS Admin Login Panel - Detect

Ilch CMS admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ilch CMS admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ilch CMS Admin Login Panel - Detect',...

Palo Alto Expedition - Admin Account Takeover Detection

Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with network access to Expedition. !/usr/bin/env python3 -- coding: utf-8 -- """Missing authentication for a critical function in Palo Alto Networks...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal Detection

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. !/usr/bin/env python3 -- coding: utf-8 -- """TRUfusion Enterprise versions...

Trinity Audio <= 5.21.0 - Information Exposure Detection

The Trinity Audio Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.21.0 via the /admin/inc/phpinfo.php file that gets created on install. This makes it possible for...

Zenario Admin Login Panel - Detect

Zenario admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zenario admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zenario Admin Login Panel - Detect',...

Shopware CMS detect

Detects Shopware CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Shopware CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Shopware CMS detect', 'description': 'Detects Shopware CMS', 'author':...