Gitea - User Enumeration Detection

Enumerates the users registered in the Gitea web application, a self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerates the users registered in the Gitea web...

Combodo iTop <2.2.0-2459 - Cross-Site Scripting Detection

Combodo iTop before 2.2.0-2459 contains a cross-site scripting vulnerability in application/dashboard.class.inc.php which allows remote attackers to inject arbitrary web script or HTML via a dashboard title. !/usr/bin/env python3 -- coding: utf-8 -- """Combodo iTop before 2.""" from kittysploit...

SAP NetWeaver Application Server Java 7.5 - Local File Inclusion Detection

SAP NetWeaver Application Server Java 7.5 is susceptible to local file inclusion in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS. This can allow remote attackers to read arbitrary files via a .. dot dot in the query string, as exploited in the wild in August 2017, aka SAP Security Note...

LimeSurvey 4.1.11 - Local File Inclusion Detection

LimeSurvey before 4.1.12+200324 is vulnerable to local file inclusion because it contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php. !/usr/bin/env python3 -- coding: utf-8 -- """LimeSurvey before 4.""" import re from kittysploit import from...

Bitrix24 <=20.0.0 - Cross-Site Scripting Detection

The Web Application Firewall in Bitrix24 up to and including 20.0.0 allows XSS via the itemsITEMSID parameter to the components/bitrix/mobileapp.list/ajax.php/ URI. !/usr/bin/env python3 -- coding: utf-8 -- """The Web Application Firewall in Bitrix24 up to and including 20.""" from kittysploit...

Micro Focus UCMDB - Remote Code Execution Detection

Micro Focus UCMDB is susceptible to remote code execution. Impacted products include Operation Bridge Manager versions 2020.05, 2019.11, 2019.05, 2018.11, 2018.05, 10.63,10.62, 10.61, 10.60, 10.12, 10.11, 10.10 and all earlier versions, and Operations Bridge containerized 2020.05, 2019.08, 2019.0...

Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution Detection

Micro Focus Operations Bridge Manager in versions 2020.05 and below is vulnerable to remote code execution via UCMDB. The vulnerability allows remote attackers to execute arbitrary code on affected installations of Data Center Automation. An attack requires network access and authentication as a...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted ...

Apache Spark Application UI - Exposed Detection

Detects exposed PySparkShell Application UI by Apache Spark on port 4040. The UI should not be exposed to the internet as it may leak sensitive job and cluster information. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed PySparkShell Application UI by Apache Spark on port 4040.""" fr...

Apache Hive - Detect

Apache Hive web application was detected, a data warehouse software facilitates reading, writing, and managing large datasets residing in distributed storage using SQL. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Hive web application was detected, a data warehouse software facilitates...

Apache Ozone - Exposure Detection

Detects if path /conf of Apache Ozone web application is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Detects if path /conf of Apache Ozone web application is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Application Management Panel - Detect

Application Management Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Application Management Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Application Management Panel - Detect...

Apache Ozone - Detect

Detects a Apache Ozone web application, a scalable, redundant, and distributed object store for Hadoop and Cloud-native environments. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Ozone web application, a scalable, redundant, and distributed object store for Hadoop and Clo.""" fro...

Azure Instrumentation Key - Exposure Detection

Detected exposed Azure Application Insights Instrumentation Keys classic ikey format in HTTP responses, which allowed anyone to send telemetry data and, in some older configurations, could enable read access via undocumented or legacy APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected...

Red Hat JBoss Enterprise Application Platform - Sensitive Information Disclosure Detection

Red Hat JBoss Enterprise Application Platform 4.2 before 4.2.0.CP09 and 4.3 before 4.3.0.CP08 is susceptible to sensitive information disclosure. A remote attacker can obtain sensitive information about "deployed web contexts" via a request to the status servlet, as demonstrated by a full=true...

Codeigniter Application Installer Exposure Detection

Codeigniter Application is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Codeigniter Application is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from...

WordPress Candidate Application Form <= 1.3 - Local File Inclusion Detection

WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Candidate Application Form = 1.""" import re from kittysploit import from...

Laravel Ignition - Log Viewer Information Disclosure Detection

Laravel Ignition's log viewer endpoint is publicly accessible and exposes application logs. These logs may contain stack traces, SQL queries, environment variables, API keys, user data, and other sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel Ignition's log viewer...

Micro Focus Application Lifecycle Management - Panel Detection

Micro Focus Application Lifecycle Management login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Micro Focus Application Lifecycle Management login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

Oracle Application Server Panel - Detect

Oracle Application Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Application Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Application...