Vite server.fs.deny Bypass - Local File Inclusion Detection

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest- script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...

esm.sh <= v136 - Local File Inclusion Detection

esm.sh = 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request. !/usr/bin/env python3 -- coding: utf-8 -- """esm.""" import re from kittysploit import from...

OneUptime < 10.0.21 - Path Traversal Detection

OneUptime 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """OneUptime 10.""" import re from...

Discover db schema files Detection

This file is auto-generated from the current state of the database. !/usr/bin/env python3 -- coding: utf-8 -- """This file is auto-generated from the current state of the database.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

db.xml File - Detect

db.xml file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """db.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'db.xml File - Detect', 'description': 'db.xml file was detected.', 'author': 'KittySploit...

CKFinder - Unauthenticated Exposure Detection

The CKFinder file manager was found to be exposed without authentication, allowing unauthenticated users to directly access its web interface. Due to this misconfiguration, attackers were able to browse server directories, upload arbitrary files, and manage existing files. !/usr/bin/env python3 -...

WordPress Contact Form 7 - Full Path Disclosure Detection

The WordPress Contact Form 7 plugin was detected to be vulnerable to Full Path Disclosure, where direct access to PHP files revealed the full server filesystem path and could aid further exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Contact Form 7 plugin was detected to...

WordPress WP Fastest Cache Plugin - Full Path Disclosure Detection

WordPress plugin WP Fastest Cache internal file system path was disclosed through direct access to unprotected PHP files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin WP Fastest Cache internal file system path was disclosed through direct access to unprotected.""" from kittysploi...

WordPress Pretty Links - Full Path Disclosure Detection

WordPress Pretty Links plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pretty Links plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WP Smushit - Full Path Disclosure Detection

Smushit WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Smushit WordPress plugin contains ...

WordPress SVG Support - Full Path Disclosure Detection

The WordPress SVG Support plugin was detected to have publicly accessible PHP files without ABSPATH protection, which exposed sensitive server path information. Direct access to vendor/composer files triggered PHP fatal errors that revealed the full WordPress filesystem path. !/usr/bin/env python...

WordPress W3 Total Cache - Cache Files Exposure Detection

Detects publicly accessible W3 Total Cache database cache files in the wp-content/w3tc/dbcache/ directory. When database caching to disk is enabled, these files contain raw SQL query results, potentially exposing sensitive data such as user details, password hashes, emails, or other database...

Yarn Lock File Disclosure Detection

The yarn.lock file stores the versions of each Yarn dependency installed. It's a lock file for package.json. !/usr/bin/env python3 -- coding: utf-8 -- """The yarn.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Yarn...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress Plugin Imsanity - Full Path Disclosure Detection

WordPress Imsanity plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Imsanity plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress SEO Plugin Rank Math - Full Path Disclosure Detection

WordPress Rank Math SEO plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Rank Math SEO plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress WP Mail SMTP - Full Path Disclosure Detection

WordPress WP Mail SMTP plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP Mail SMTP plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Xerox DC260 EFI Fiery Controller Webtools 2.0 - Local File Inclusion Detection

Xerox DC260 EFI Fiery Controller Webtools 2.0 is vulnerable to local file inclusion because input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files ...

Zen Cart Log File Exposure Detection

Detected exposed Zen Cart log files that may contain sensitive information including error messages, file paths, database queries, and customer data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Zen Cart log files that may contain sensitive information including error messages,...

Oauth Credentials Json Detection

Oauth Credentials file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Oauth Credentials file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oauth Credentials Json Detection', 'description':...