Untangle Exposed Admin Signup Detection

Untangle Exposed Admin Signup is exposed publicly. !/usr/bin/env python3 -- coding: utf-8 -- """Untangle Exposed Admin Signup is exposed publicly.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Untangle Exposed Admi...

TeamCity < 2023.11.4 - Authentication Bypass Detection

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible !/usr/bin/env python3 -- coding: utf-8 -- """In JetBrains TeamCity before 2023.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

TeamCity < 2023.11.4 - Authentication Bypass Detection

In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible !/usr/bin/env python3 -- coding: utf-8 -- """In JetBrains TeamCity before 2023.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Campaign Monitor for WordPress - Information Disclosure Detection

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

W&B Weave Server - Remote Arbitrary File Leak Detection

The Weave server API allows remote users to fetch files from a specific directory, but due to a lack of input validation, it is possible to traverse and leak arbitrary files remotely. In various common scenarios, this allows a low-privileged user to assume the role of the server admin...

LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure Detection

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

Delta Controls Admin Login Panel - Detect

Delta Controls admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Delta Controls admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Delta Controls Admin Login...

Dynamicweb Login Panel - Detect

Dynamicweb login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dynamicweb login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dynamicweb Login Panel - Detect', 'description':...

FusionAuth Exposed Admin Setup Detection

FusionAuth Admin Setup is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """FusionAuth Admin Setup is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FusionAuth Exposed Admin Setup Detection',...

iClock Automatic Data Master Server Admin Panel - Detect

An iClock Automatic Data Master Server Admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An iClock Automatic Data Master Server Admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

Dialogic XMS Admin Console - Detect

Detects Dialogic XMS Admin Console - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dialogic XMS Admin Console - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dialogic XMS Admin Console -...

HuangDou UTCMS V9 - OS Command Injection Detection

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...

Dgraph <= 25.3.2 - Admin Token Disclosure Detection

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

Python Django Admin Login Panel - Detect

Python Django admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Python Django admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Python Django Admin Login Panel...

FortiOS Admin Login Panel - Detect

FortiOS admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FortiOS admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FortiOS Admin Login Panel - Detect',...

FusionAuth Admin Panel - Detect

Detects FusionAuth Admin Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FusionAuth Admin Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FusionAuth Admin Panel - Detect',...

Grav Register Admin User - Detect

Exposed Grav admin user register page. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Grav admin user register page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Grav Register Admin User - Detect',...

IBM WebSphere Application Server Community Edition Admin Login Panel - Detect

IBM WebSphere Application Server Community Edition admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM WebSphere Application Server Community Edition admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AdminBro Dashboard - Unauthenticated Access Detection

Detected AdminBro/AdminJS admin panel was exposed without authentication, allowing unauthenticated users to access the admin dashboard and potentially view, modify, or delete sensitive data. This misconfiguration occurred when developers used buildRouter instead of buildAuthenticatedRouter...