Prometheus Config API Endpoint Discovery Detection

A Prometheus config API endpoint was discovered. The config endpoint returns the loaded Prometheus configuration file along with the addresses of targets and alerting/discovery services alongside the credentials required to access them. Usually, Prometheus replaces the passwords in the credential...

S3CMD Configuration - Detect

S3CMD configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """S3CMD configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'S3CMD Configuration - Detect',...

HTaccess config file Detection

Detects HTaccess config file. !/usr/bin/env python3 -- coding: utf-8 -- """Detects HTaccess config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HTaccess config file Detection', 'description': 'Detects HTacce...

Ruijie Phpinfo Configuration - Detect

Ruijie phpinfo configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ruijie phpinfo configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ruijie Phpinfo Configuration - Detect...

Symfony Security Configuration File - Detect

Symfony security configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Symfony security configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Symfony Security...

Spring Cloud Config Server - Local File Inclusion Detection

Spring Cloud Config Server versions 2.2.x prior to 2.2.3, versions 2.1.x prior to 2.1.9, and older unsupported versions allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. A malicious user or attacker can send a request using a specially crafte...

pyLoad Flask Config - Access Control Detection

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77. !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad...

Dnsmasq Config - File Disclosure Detection

Dnsmasq Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Dnsmasq Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dnsmasq Config - File Disclosure Detection', 'description':...

Build Properties File Exposure Detection

Detects Build Properties File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Build Properties File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Build Properties File Exposure Detection',...

Sensitive Storage Data - Detect

A generic search for 'storage' in sensitive key files, file names, logs, etc., returned a match. !/usr/bin/env python3 -- coding: utf-8 -- """A generic search for 'storage' in sensitive key files, file names, logs, etc.""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Web Configuration File - Detect

Web configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Web configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Web Configuration File - Detect', 'description':...

Elastic Kibana Config - File Disclosure Detection

Elastic Kibana Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Elastic Kibana Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elastic Kibana Config - File Disclosure...

CVE-2026-11841

An attacker may perform unauthenticated read and write operations on sensitive filesystem areas via the AppEngine Fileaccess over HTTP due to improper access restrictions. A critical filesystem directory was unintentionally exposed through the HTTP-based file access feature, allowing access witho...

PT-2026-65500

Mattermost versions 11.8.x = 11.8.0, 11.7.x = 11.7.3, 11.6.x = 11.6.5, 10.11.x = 10.11.20 fail to verify file deletion path which allows an admin with SAML system-console write permissions to delete arbitrary files outside the config directory from the server via the remove file endpoint...

PT-2026-65570

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the...

libssh-config-0.11.5-1.1 on GA media (moderate)

libssh-config-0.11.5-1.1 on GA media Announcement ID: openSUSE-SU-2026:11377-1 Rating: moderate Cross-References: CVE-2026-15370 CVE-2026-59843 CVE-2026-59844 CVE-2026-59845 CVE-2026-59846 CVE-2026-59847 CVE-2026-59848 CVE-2026-59849 CVE-2026-59850 CVSS scores: CVE-2026-15370 SUSE : 6.7...

Malicious Package

Overview bcore-bravo-eslint-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview pfa-prettier-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview cryptodao-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview atlasora-config is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...