WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in...

Jeesns 1.4.2 - Cross-Site Scripting Detection

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /newVersion component and allows attackers to execute arbitrary web scripts or HTML. !/usr/bin/env python3 -- coding: utf-8 -- """Jeesns 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XSpeeder Login - Detect

Detects the presence of XSpeeder router login panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of XSpeeder router login panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XSpeeder Login ...

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution Detection

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 for Time Clock and 1.1.4 for Time Clock Pro via the 'etimeclockwploadfunctioncallback' function. This allows unauthenticated attackers to execute code on t...

Chanjet TPlus DownloadProxy.aspx - Arbitrary File Read Detection

Chanjet TPlus DownloadProxy.aspx file has an arbitrary file reading vulnerability. An attacker can obtain sensitive files on the server through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Chanjet TPlus DownloadProxy.""" from kittysploit import from lib.protocols.http.httpclien...

W3 Total Cache < 2.8.2 - Log File Exposure Detection

The plugin is vulnerable to Information Exposure through the publicly exposed debug log file. This makes it possible for unauthenticated attackers to view potentially sensitive information in the exposed log file. For example, the log file may contain nonce values that can be used in further CSRF...

Firestore Public REST Access

Probe Cloud Firestore REST /v1/projects/project/databases/default/documents for anonymous list access. Project ID can be set explicitly or scraped from the target HTML/JS. !/usr/bin/env python3 -- coding: utf-8 -- """Detect unauthenticated Firestore REST document listing.""" import re from...

Revive Adserver <=5.0.3 - Cross-Site Scripting Detection

Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php...

Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution Detection

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed. !/usr/bin/env python3 -- coding: utf-8 -- """Intellian Aptus W...

Parallels H-Sphere Login Panel - Detect

Parallels H-Sphere login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Parallels H-Sphere login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Parallels H-Sphere Login Panel -...

Atlassian Jira Seraph - Authentication Bypass Detection

Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also...

vBulletin SQL Injection Detection

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control that permits SQL injection attacks. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin before 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Joomla! Component Graphics 1.0.6 - Local File Inclusion Detection

A directory traversal vulnerability in graphics.php in the Graphics comgraphics component 1.0.6 and 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Python Django Admin Login Panel - Detect

Python Django admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Python Django admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Python Django Admin Login Panel...

WordPress Plugin Google Tag Manager - Full Path Disclosure Detection

WordPress Plugin Google Tag Manager files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Google Tag Manager files are publicly accessibl...

OurMGMT3 Admin Login Panel - Detect

OurMGMT3 admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OurMGMT3 admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OurMGMT3 Admin Login Panel - Detect',...

GitLab CE/EE - Hard-Coded Credentials Detection

GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML, allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab...

Apache Impala - Exposure Detection

Apache Impala is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Impala is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Impala - Exposure Detection', 'description': 'Apache Impala is...

WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion Detection

WordPress Advanced Access Manager versions before 5.9.9 are vulnerable to local file inclusion and allows attackers to download the wp-config.php file and get access to the database, which is publicly reachable on many servers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Acces...

Ollama - Improper Authorization Detection

Detected an exposed Ollama API without proper authorization, allowing unauthorized access to AI models and operations. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed Ollama API without proper authorization, allowing unauthorized access to AI models and ope.""" from kittysploit...