CVE-2026-19904: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

PT-2026-73044

Name of the Vulnerable Software and Affected Versions SourceCodester Online Book Store System version 1.0 Description Cross site scripting occurs in the System Settings Module within the file '/admin/index.php?page=site settings'. This issue allows a remote attacker to execute malicious scripts...

DedeCMS Setup Code Execution

The vulnerability of the 4Setup function in the DedeCMS content management system’s install/index.php script is related to improper external manipulation of file names or file paths. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CaupoShop - template LFI Detection (CVE-2011-4832)

Detects CVE-2011-4832 via index.php?action=template&template=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4832 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

FreePBX ARI - Cookie Auth Bypass Detection (CVE-2014-7235)

Detects CVE-2014-7235 by sending crafted ariauth cookie to /recordings/index.php and matching authenticated UI markers. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX ARI recordings auth bypass CVE-2014-7235.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

up.time - firstTimeLogin Authentication Bypass Detection

Detects up.time = 5.0 auth bypass surface via index.php?userid=admin&firstTimeLogin=True matching blank-password validation response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects up.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

phpMyFAQ - Compromised Package Backdoor Detection (CVE-2010-4558)

Detects CVE-2010-4558 via index.php?phpmyfaqnew=cGhwaW5mbygpOwo= phpinfo;. !/usr/bin/env python3 -- coding: utf-8 -- """phpMyFAQ backdoor CVE-2010-4558.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'phpMyFAQ -...

PT-2026-69477

Name of the Vulnerable Software and Affected Versions dulldusk/phpfm versions prior to 1.8.1 Description A missing authentication flaw allows an unauthenticated remote attacker to access the full file manager functionality. This enables the reading, writing, deleting, and uploading of files...

CVE-2026-19353

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

PT-2026-69065

Name of the Vulnerable Software and Affected Versions SourceCodester Photo Share Website version 1.0 Description A remote cross-site scripting issue exists in the /social/index.php?page=home endpoint. The flaw occurs when the Comment argument is manipulated, allowing an attacker to execute...

CVE-2026-19209: Improper Neutralization of Input During Web Page Generation

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-71237: Improper Neutralization of Special Elements used in an SQL Command

Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from 'pwd' with no sanitization and concatenates it into a raw SQL string: mysqlquery"select from userlists where username='' and password='' limit 1". An unauthenticated attacker can submit a payload...

CVE-2026-18720: Improper Authorization

A flaw has been found in kalcaddle kodbox 1.67 Build 02. This vulnerability affects unknown code of the file /index.php?plugin/msgWarning/action of the component msgWarning Plugin. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The explo...

MAMP Server - Cross-Site Scripting Detection

A Cross-Site Scripting XSS vulnerability exists in the default installation of MAMP server. The file /Applications/MAMP/htdocs/index.php is susceptible to malicious input, allowing attackers to inject JavaScript code that executes in the context of the victim's browser. This vulnerability can be...

Joomla! Component com_gcalendar Suite 2.1.5 - Local File Inclusion Detection

A directory traversal vulnerability in the GCalendar comgcalendar component 2.1.5 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal...

Joomla! Component Cookex Agency CKForms - Local File Inclusion Detection

A directory traversal vulnerability in the Cookex Agency CKForms comckforms component 1.3.3 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in th...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BIQS IT Biqs-drive v1.83 Local File Inclusion Detection

A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user. !/usr/bin/env...

YzmCMS v3.6 - Cross-Site Scripting Detection

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. !/usr/bin/env python3 -- coding: utf-8 -- """In YzmCMS 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YzmCMS v3.6 - Cross-Site Scripting Detection',...

Processwire CMS <2.7.1 - Local File Inclusion Detection

Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """Processwire CMS prior to 2.""" import re from kittysploit import from...