Liferay Portal - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

Devtron JavaScript Environment Configuration - Exposure Detection

Devtron JavaScript environment configuration file was identified at /dashboard/env-config.js, exposing internal API endpoints and feature flag settings. !/usr/bin/env python3 -- coding: utf-8 -- """Devtron JavaScript environment configuration file was identified at /dashboard/env-config.""" from...

KafDrop - Cross-Site Scripting Detection

KafDrop contains a cross-site scripting vulnerability. It allows remote unauthenticated attackers to inject arbitrary HTML and/or JavaScript into the response returned by the server. !/usr/bin/env python3 -- coding: utf-8 -- """KafDrop contains a cross-site scripting vulnerability.""" from...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HTML Email Template Designer < 3.1 - Missing Authorization on Rest Route Detection

The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the /includes/class-template-designer.php file, in versions up to...

QSAN Storage Manager <3.3.3 - Cross-Site Scripting Detection

QSAN Storage Manager before 3.3.3 contains a reflected cross-site scripting vulnerability. Header page parameters do not filter special characters. Remote attackers can inject JavaScript to access and modify specific data. !/usr/bin/env python3 -- coding: utf-8 -- """QSAN Storage Manager before...

Aurelia-Path < 1.1.7 - Prototype Pollution Detection

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. !/usr/bin/env python3 -- coding: utf-8 -- """Aurelia-path before 1.""" from kittysploit...

ServiceNow - Cross-Site Scripting Detection

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """ServiceNow through San Diego Patch 4b and...

Mailcow < 2026-03b - Href Link Injection Detection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. !/usr/bin/env python3 -- coding: utf-8 -- """mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

A reflected XSS vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master commit 3c6bb3ff, allowing arbitrary Javascript execution. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected XSS vulnerability exists in the functiongetOpenGraph...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

YesWiki - Cross-Site Scripting Detection

YesWiki versions 4.5.3 are vulnerable to multiple reflected cross-site scripting XSS vulnerabilities, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki versions 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

RockMongo 1.1.8 - Cross-Site Scripting Detection

RockMongo 1.1.8 contains a cross-site scripting vulnerability which allows attackers to inject arbitrary JavaScript into the response returned by the application. !/usr/bin/env python3 -- coding: utf-8 -- """RockMongo 1.""" from kittysploit import from lib.protocols.http.httpclient import...

Weglot API Key - Exposed Detection

Detected Weglot API key was found exposed in a publicly accessible JavaScript file. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weglot API key was found exposed in a publicly accessible JavaScript file.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Gnuboard CMS - Cross-Site Scripting Detection

Gnuboard CMS contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary JavaScript into the responses returned by the server. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard CMS contains a cross-site scripting vulnerability which allows remote attackers ...