AKHQ Panel Detection

Detects AKHQ Kafka HQ login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AKHQ Kafka UI panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AKHQ Panel Detection", "description": "Detects AKHQ...

SonarQube Detection

Detects SonarQube system status API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed SonarQube instances.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "SonarQube Detection", "description":...

Gitea Detection

Detects Gitea version API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Gitea git forge.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner, Httpclient: info =...

Kubernetes Dashboard Detection

Detects Kubernetes Dashboard login UI and proxy API paths. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Kubernetes Dashboard UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kubernetes Dashboard...

Rocket.Chat Detection

Detects Rocket.Chat info API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Rocket.Chat collaboration server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Apache Superset Detection

Detects Superset health API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Superset BI dashboard.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import ishtmlresponse, parsejsonresponse class...

Open WebUI Detection

Detects Open WebUI config API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Open WebUI LLM chat interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse, ishtmlresponse class...

Argo CD Detection

Detects Argo CD version API and login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect exposed Argo CD GitOps UI.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Argo CD Detection", "description":...

TeamCity Detection

Detects TeamCity REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect JetBrains TeamCity CI server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanner,...

Splunk Detection

Detects Splunk management REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Splunk Enterprise web/API interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlresponse, ishtmlresponse...

Bitbucket Detection

Detects Bitbucket REST API and login UI. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Atlassian Bitbucket Server/Data Center.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import parsejsonresponse class ModuleScanne...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

CVE-2026-38979

ajenti through v2.2.13 has a clickjacking weakness in the browser-facing login and administrative UI. In ajenti-core/aj/http.py, the core HTTP response path initializes an empty header list, forwards handler-added headers verbatim, and finalizes responses through WSGI startresponse without adding...

Server-Side Request Forgery (SSRF)

github.com/zitadel/zitadel is vulnerable to an unauthenticated full-read Server-Side Request Forgery SSRF. The vulnerability is due to improper trust of the x-zitadel-forward-host header in the Login UI V2, which allows an attacker to force the server to make arbitrary HTTP requests and read...

GO-2026-4319 Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel

Zitadel has a user enumeration vulnerability in Login UIs in github.com/zitadel/zitadel. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability...

EUVD-2024-0935

Malicious code in bioql PyPI...

CVE-2024-28855

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the text/template instead of the html/template package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15, and...

PT-2024-23115

Name of the Vulnerable Software and Affected Versions ZITADEL versions prior to 2.42.17 ZITADEL versions 2.42.17 through 2.48.3 Description The issue arises from the use of Go templates to render the login UI in ZITADEL, allowing actions to set reserved claims under certain circumstances. For...

Cross-site Scripting (XSS)

ZITADEL is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization when rendering login UI templates. This vulnerability allows an attacker to inject HTML into the login page via crafted links...

CVE-2024-28855

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Due to a improper use of the "text/template" instead of the "html/template" package, the Login UI did not sanitize input parameters prior to versions 2.47.3, 2.46.1, 2.45.1, 2.44.3, 2.43.9, 2.42.15,...