CopyParty v1.8.6 - Cross Site Scripting Detection

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack.Vulnerability that exists in the web interface of the application could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link...

Aurelia-Path < 1.1.7 - Prototype Pollution Detection

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. !/usr/bin/env python3 -- coding: utf-8 -- """Aurelia-path before 1.""" from kittysploit...

XWiki >= 13.10.8 - Cross-Site Scripting Detection

Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected XSS vulnerability in XWiki authenticate endpoints allows execution of arbitrary JavaScript.""" from kittysploit import from...

ServiceNow - Cross-Site Scripting Detection

ServiceNow through San Diego Patch 4b and Patch 6 contains a cross-site scripting vulnerability in the logout functionality, which can enable an unauthenticated remote attacker to execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """ServiceNow through San Diego Patch 4b and...

XWiki >= 6.0-rc-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as:...

XWiki >= 6.2-milestone-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the DeleteApplication page to perform a XSS, e.g. by using URL such as:...

Fronsetiav1.1 - Cross-Site Scripting Detection

The fronsetiav1.1 application is vulnerable to a Reflected XSS attack through the showoperations.jsp endpoint. An attacker can inject malicious scripts via the WSDL Location input, which is executed in the victim's browser due to improper input sanitization. This allows attackers to execute...

PAN-OS - Reflected Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The...

Liferay Portal - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

Mailcow < 2026-03b - Href Link Injection Detection

mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the login page, allowing attackers to inject parameters that break JS logic and enable phishing. !/usr/bin/env python3 -- coding: utf-8 -- """mailcow 2026-03b reflects raw REQUESTURI into JavaScript and href links on the...

Devtron JavaScript Environment Configuration - Exposure Detection

Devtron JavaScript environment configuration file was identified at /dashboard/env-config.js, exposing internal API endpoints and feature flag settings. !/usr/bin/env python3 -- coding: utf-8 -- """Devtron JavaScript environment configuration file was identified at /dashboard/env-config.""" from...

Rumpus FTP Web File Manager 8.2.9.1 - Cross-Site Scripting Detection

Rumpus FTP Web File Manager 8.2.9.1 contains a reflected cross-site scripting vulnerability via the Login page. An attacker can send a crafted link to end users and can execute arbitrary JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Rumpus FTP Web File Manager 8.""" from kittysploit...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet is vulnerable to cross-site scripting via the devicegraphpage.php script via the is2sim parameter. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet is...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting Detection

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting Detection

A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be executed remote...

Add DOM EventListener - Detection

Identifies the use of JavaScript addEventListener calls in the DOM. !/usr/bin/env python3 -- coding: utf-8 -- """Identifies the use of JavaScript addEventListener calls in the DOM.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...