Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion Detection

Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Zeta Producer Desktop CMS before 14.""" import r...

Anchor CMS 0.12.3 - Error Log Exposure Detection

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. !/usr/bin/env python3 -- coding: utf-8 --...

strapi CMS <3.0.0-beta.17.5 - Admin Password Reset Detection

strapi CMS before 3.0.0-beta.17.5 allows admin password resets because it mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. !/usr/bin/env python3 -- coding: utf-8 -- """strapi CMS before 3.""" from...

BlogEngine CMS - Open Redirect Detection

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect !/usr/bin/env python3 -- coding: utf-8 -- """Blogengine.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BlogEngine CMS - Open Redirect...

Kentico Xperience 13 CMS - Staging None-password Authentication Bypass

Kentico Staging SyncServer None-type password handling auth bypass WT-2025-0006. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging None-password Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

EP Web Solutions CMS - Cross Site Scripting Detection

Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of a trusted application or website. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting is an attack in which an attacker injects malicious executable scripts into the code of...

Typo3 composer.json Exposure Detection

The web application is based on Typo3 CMS. A sensitive file has been found. Access to such files must be restricted, as it may lead to disclosure of sensitive information about the web application. !/usr/bin/env python3 -- coding: utf-8 -- """The web application is based on Typo3 CMS.""" from...

Oqtane CMS Database - Detect

Detect which database distribution the target oqtane cms use. !/usr/bin/env python3 -- coding: utf-8 -- """Detect which database distribution the target oqtane cms use.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

PayloadCMS - Detect

PayloadCMS panel was detected. PayloadCMS is an open-source, headless CMS and application framework built with Node.js, React, and TypeScript. !/usr/bin/env python3 -- coding: utf-8 -- """PayloadCMS panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Quilium Panel - Detect

Quilium CMS Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Quilium CMS Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Quilium Panel - Detect', 'description': 'Quiliu...

Rhymix CMS Detect

Detects Rhymix CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Rhymix CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Rhymix CMS Detect', 'description': 'Detects Rhymix CMS', 'author': 'KittySploit Team...

Strapi CMS Documentation Login Panel - Detect

Strapi CMS Documentation login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi CMS Documentation login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Strapi CMS...

Subrion CMS Web Installer - Exposure Detection

Subrion CMS Web Installer has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Subrion CMS Web Installer has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Subrion CMS Web Installer - Exposur...

WoW CMS Installer Exposure Detection

WoW CMS is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """WoW CMS is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Grav CMS Detect

Detects Grav CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Grav CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Grav CMS Detect', 'description': 'Detects Grav CMS', 'author': 'KittySploit Team',...

Universal Media Server v13.2.1 - Cross Site Scripting Detection

Universal Media Server v13.2.1 CMS v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Universal Media Server v13.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303 Path Traversal in Quick.CMS

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303

A Path Traversal vulnerability exists in Quick.CMS through the URI path component of HTTP requests, where the server fails to normalize dot-dot-slash ../ sequences before resolving and serving the requested file. An authenticated attacker with admin privileges can use this vulnerability to read...

CVE-2026-63303

Summary: CVE-2026-63303 describes a path traversal in Quick.CMS where the URI path component does not normalize ../ sequences, allowing an authenticated admin to read files in the webroot’s sibling directory. Affected product is Quick.CMS (component: URI handling). Underlying cause: failure to no...