Argo CD Detection

Detects Argo CD version API and login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Argo CD GitOps UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Argo CD Detection", "description":...

Bitbucket Detection

Detects Bitbucket REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Atlassian Bitbucket Server/Data Center.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanne...

MySQL login bruteforce

Attempts common and wordlist-based MySQL/MariaDB credentials. Use only on authorized targets — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- """ MySQL login bruteforce — tests username/password combinations against a MySQL/MariaDB server. """ from future import annotations...

Webmin Detection

Detects Webmin login and session endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Webmin server administration panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse class ModuleScanner,...

Kubernetes Dashboard Detection

Detects Kubernetes Dashboard login UI and proxy API paths. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Kubernetes Dashboard UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kubernetes Dashboard...

SonarQube Detection

Detects SonarQube system status API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed SonarQube instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SonarQube Detection", "description":...

TeamCity Detection

Detects TeamCity REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JetBrains TeamCity CI server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Kubernetes Dashboard Unauth Verification

Confirms Kubernetes Dashboard settings allowing skip-login or open proxy API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify Kubernetes Dashboard skip-login and API proxy exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Apache Superset Detection

Detects Superset health API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset BI dashboard.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse, parsejsonresponse class...

Splunk Detection

Detects Splunk management REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Splunk Enterprise web/API interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlresponse, ishtmlresponse...

Open WebUI Detection

Detects Open WebUI config API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open WebUI LLM chat interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

Gitea Detection

Detects Gitea version API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea git forge.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner, Httpclient: info =...

Rocket.Chat Detection

Detects Rocket.Chat info API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rocket.Chat collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Citrix NetScaler CVE-2026-8451 detection

Detects Citrix NetScaler/ADC instances vulnerable to CVE-2026-8451 by sending crafted SAML requests to /saml/login and checking the NSCTASS cookie for memory overread artifacts. !/usr/bin/env python3 -- coding: utf-8 -- import base64 import ssl from requests.adapters import HTTPAdapter from...

EUVD-2026-42760

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpressonspotifylogin function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it...

CVE-2026-12598

The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in versions up to and including 6.2.3 via the Spotify Social Login addon. This is due to the loginpressonspotifylogin function trusting the unverified 'email' field returned by Spotify's /v1/me endpoint and using it...

CVE-2026-12761: Improper Authentication

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn plugin for WordPress is vulnerable to authentication bypass leading to account takeover in versions up to and including 7.7.0. This is due to the Profile Completion flow accepting an arbitrary email address via the...

CVE-2026-56667: Improper Neutralization of Input During Web Page Generation

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a...

CVE-2026-15290: Improper Neutralization of Special Elements used in an SQL Command

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to blind SQL Injection via the search parameter in all versions up to, and including, 2.10.1 due to insufficient escaping on the user supplied...

PT-2026-57255

ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL Login V2 OIDC and SAML FailedPrecondition error paths return loginSettings.defaultRedirectUri to router.push without applying the isSafeRedirectUri check, allowing an organization or instance administrator to store a...