Mailcow < 2026-03b - Href Link Injection Detection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. !/usr/bin/env python3 -- coding: utf-8 -- """mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the...

Add DOM EventListener - Detection

Identifies the use of JavaScript addEventListener calls in the DOM. !/usr/bin/env python3 -- coding: utf-8 -- """Identifies the use of JavaScript addEventListener calls in the DOM.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting Detection

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the cyclePeriod parameter. !/usr/bin/env python3 -- coding: utf-8 -- """The WallboardServlet resource in Jira before version 7."""...

Timesheet Next Gen <=1.5.3 - Cross-Site Scripting Detection

Timesheet Next Gen 1.5.3 and earlier is vulnerable to cross-site scripting that allows an attacker to execute arbitrary HTML and JavaScript code via a "redirect" parameter. The component is: Web login form: login.php, lines 40 and 54. The attack vector is: reflected XSS, victim may click the...

MindPalette NateMail 3.0.15 - Cross-Site Scripting Detection

MindPalette NateMail 3.0.15 is susceptible to reflected cross-site scripting which could allows an attacker to execute remote JavaScript in a victim's browser via a specially crafted POST request. The application will reflect the recipient value if it is not in the NateMail recipient array. Note...

Copyparty v1.8.6 - Cross-Site Scripting Detection

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack. The vulnerability in the application's web interface could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. !/usr/bin/e...

Fronsetiav1.1 - Cross-Site Scripting Detection

The fronsetiav1.1 application is vulnerable to a Reflected XSS attack through the showoperations.jsp endpoint. An attacker can inject malicious scripts via the WSDL Location input, which is executed in the victim's browser due to improper input sanitization. This allows attackers to execute...

MajorDoMo - Cross-Site Scripting Detection

MajorDoMo contains a reflected XSS caused by unsanitized $qry parameter in command.php, letting attackers inject arbitrary JavaScript via crafted URLs, exploit requires victim to visit malicious URL. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a reflected XSS caused by...

Devtron JavaScript Environment Configuration - Exposure Detection

Devtron JavaScript environment configuration file was identified at /dashboard/env-config.js, exposing internal API endpoints and feature flag settings. !/usr/bin/env python3 -- coding: utf-8 -- """Devtron JavaScript environment configuration file was identified at /dashboard/env-config.""" from...

Weglot API Key - Exposed Detection

Detected Weglot API key was found exposed in a publicly accessible JavaScript file. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Weglot API key was found exposed in a publicly accessible JavaScript file.""" import re from kittysploit import from lib.protocols.http.httpclient import...

SMTP Credentials Exposure - Detection

Detects exposed SMTP credentials username and password in a webpage's HTML or JavaScript source code. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed SMTP credentials username and password in a webpage's HTML or JavaScript source code.""" from kittysploit import from...

RockMongo 1.1.8 - Cross-Site Scripting Detection

RockMongo 1.1.8 contains a cross-site scripting vulnerability which allows attackers to inject arbitrary JavaScript into the response returned by the application. !/usr/bin/env python3 -- coding: utf-8 -- """RockMongo 1.""" from kittysploit import from lib.protocols.http.httpclient import...

TurboCRM - Cross-Site Scripting Detection

TurboCRM contains a cross-site scripting vulnerability which allows a remote attacker to inject arbitrary JavaScript into the response returned by the application. !/usr/bin/env python3 -- coding: utf-8 -- """TurboCRM contains a cross-site scripting vulnerability which allows a remote attacker to...

MAMP Server - Cross-Site Scripting Detection

A Cross-Site Scripting XSS vulnerability exists in the default installation of MAMP server. The file /Applications/MAMP/htdocs/index.php is susceptible to malicious input, allowing attackers to inject JavaScript code that executes in the context of the victim's browser. This vulnerability can be...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Oracle Siebel Loyalty 8.1 - Cross-Site Scripting Detection

A vulnerability in Oracle Siebel Loyalty allows remote unauthenticated attackers to inject arbitrary Javascript code into the responses returned by the '/loyaltyenu/start.swe/' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Oracle Siebel Loyalty allows remote...

BIT-THRIFT-2026-55968 Apache Thrift: Node.js quadratic-time DoS in server receive transports

Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

PT-2026-65610

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.51.0 through 0.60.1 Description Insufficient validation of x-python-type values in the get python type override function within src/datamodel code generator/parser/jsonschema.py allows attacker-controlled JS...

Multiples vulnerabilities in jsPDF

Brocade SANnav provides security updates for multiple CVEs affecting jsPDF. CVE-2025-68428 sPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allows local file inclusion/path traversal. If given...