CVE-2026-65881

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

CVE-2026-65881

Joomla Extension - joomdle.com - Insecure default configuration allows read/write user account access in Joomdle 3.1.1 - The default configuration of the extension allowed read access and password reset of CMS accounts...

dotAdmin Login Panel- Detect

dotAdmin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """dotAdmin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'dotAdmin Login Panel- Detect', 'description': 'dotAdm...

Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion Detection

Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Zeta Producer Desktop CMS before 14.""" import r...

LG SuperSign EZ CMS 2.5 - Local File Inclusion Detection

LG SuperSign CMS 2.5 allows reading of arbitrary files via signEzUI/playlist/edit/upload/..%2f URIs - aka local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """LG SuperSign CMS 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset Detection

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. !/usr/bin/env python3 -- coding: utf-8 -- """strapi CMS before 3.""" from...

ApostropheCMS - Detect

Detected the presence of ApostropheCMS, a full-stack content management system built on Node.js and MongoDB. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of ApostropheCMS, a full-stack content management system built on Node.""" import re from kittysploit import from...

Asanhamayesh CMS 3.4.6 - Local File Inclusion Detection

Asanhamayesh CMS 3.4.6 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Asanhamayesh CMS 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Asanhamayesh CMS 3.4.6 - Local...

Monstra CMS <=3.0.4 - Cross-Site Scripting Detection

Monstra CMS 3.0.4 and earlier contains a cross-site scripting vulnerability via index.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

Monstra CMS 3.0.4 - HTTP Header Injection Detection

Monstra CMS 3.0.4 is susceptible to HTTP header injection in the plugins/captcha/crypt/cryptographp.php cfg parameter. An attacker can potentially supply invalid input and cause the server to allow redirects to attacker-controlled domains, perform cache poisoning, and/or allow improper access to...

Anchor CMS 0.12.3 - Error Log Exposure Detection

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. !/usr/bin/env python3 -- coding: utf-8 --...

Processwire CMS <2.7.1 - Local File Inclusion Detection

Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """Processwire CMS prior to 2.""" import re from kittysploit import from...

a-blog cms - Detect

Detects the presence of a-blog cms, a Content Management System. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of a-blog cms, a Content Management System.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Craft CMS - Log File Disclosure Detection

Detected exposed Craft CMS log files due to misconfiguration, allowing unauthenticated access to sensitive information including error messages, stack traces, database queries, and potentially credentials or session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Craft CMS log...

Craft CMS Detect

Detects Craft CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Craft CMS.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Detect', 'description': 'Detects Craft CMS', 'author': 'KittySploi...

Tiki Wiki CMS Groupware 5.2 - Local File Inclusion Detection

Tiki Wiki CMS Groupware 5.2 is susceptible to a local file inclusion vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Tiki Wiki CMS Groupware 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tiki Wiki CM...

Batflat SQLite Database - Exposure Detection

Detected exposed Batflat CMS SQLite database files that may contain sensitive information including admin credentials, user data, site configuration, and content. Batflat stores its database in the /inc/data/ directory by default. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed...

Call Break CMS Panel - Detect

Call Break CMS panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Call Break CMS panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Call Break CMS Panel - Detect', 'description': 'Call...

Lokomedia CMS - Local File Inclusion Detection

A Local File Inclusion LFI vulnerability exists in Lokomedia CMS. The application allows an attacker to include files on the server that should not be accessible, potentially exposing sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """A Local File Inclusion LFI vulnerability exis...

Sitecore CMS - Cross-Site Scripting Detection

Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of displaying XML Controls directly, which allows for a Cross Site Scripting Attack. !/usr/bin/env python3 -- coding: utf-8 -- """Sitecore CMS contains a cross-site scripting vulnerability via the "special way" of...