MyBB - Full Path Disclosure Detection

Detected MyBB forum software exposed the server's full filesystem path through PHP fatal errors when files that implemented interfaces were accessed without dependencies. !/usr/bin/env python3 -- coding: utf-8 -- """Detected MyBB forum software exposed the server's full filesystem path through PH...

WordPress Hostinger Tools - Full Path Disclosure Detection

WordPress Plugin Hostinger Tools files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Hostinger Tools files are publicly accessible...

WordPress Advanced iFrame - Full Path Disclosure Detection

WordPress Advanced iFrame plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced iFrame plugin files are publicly accessible...

Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion Detection

A PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites comjoomla-visites component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A PHP...

Swift Performance Lite < 2.3.7.2 - Local PHP File Inclusion Detection

A vulnerability in Swift Performance Lite before version 2.3.7.2 allows unauthenticated attackers to perform local PHP file inclusion via the 'ajaxify' parameter. This can lead to arbitrary code execution on the server. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Swift...

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting Detection

PhpJabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting XSS via the keyword parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PhpJabbers PHP Forum Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting Detection

A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickupid leads to cross site scripting. The attack may be launched remotely...

PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting Detection

A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument sessionid leads to cross site scripting. The attack can be launched...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion Detection

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

WordPress Campress Theme <= 1.35 - Unauthenticated Local File Inclusion Detection

Campress theme for WordPress up to 1.35 contains a local file inclusion caused by 'campresswoocommercegetajaxproducts' function, letting unauthenticated attackers include and execute arbitrary PHP files, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Campress the...

Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion Detection

The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the executio...

PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier...

PHP Login System 2.0.1 - Cross-Site Scripting Detection

msaad1999's PHP-Login-System 2.0.1 contains a reflected cross-site scripting caused by unsanitized input in 'validator' parameter in /reset-password, letting remote attackers execute arbitrary JavaScript in a user's browser, exploit requires attacker to craft malicious URL !/usr/bin/env python3 -...

PMB v7.4.6 - Cross-Site Scripting Detection

PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via the 'query' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PMB v7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PMB v7.4.6 -...

Linear eMerge E3-Series - Cross-Site Scripting Detection

Linear eMerge E3-Series devices contain a cross-site scripting vulnerability via the type parameter, e.g., to the badging/badgetemplatev0.php component. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site and thus steal cookie-based...

WordPress Plugin DukaPress 2.5.2 - Directory Traversal Detection

A directory traversal vulnerability in the dpimgresize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the src parameter to lib/dpimage.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

WordPress Mailster <=1.5.4 - Cross-Site Scripting Detection

WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Mailster 1.""" from kittysploit import from lib.protocols.http.httpclien...

WP Hotel Booking < 1.10.4 - PHP Object Injection Detection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. !/usr/bin/env python3 -- coding: utf-8 -- """The wp-hotel-booking plugin...

Nette Framework - Remote Code Execution Detection

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. !/usr/bin/env python3 -- coding: utf-8 -- """Nette Framework versions before...

PHP Proxy 3.0.3 - Local File Inclusion Detection

PHP Proxy 3.0.3 is susceptible to local file inclusion vulnerabilities that allow unauthenticated users to read files from the server via index.php?q=file:/// a different vulnerability than CVE-2018-19246. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Proxy 3.""" import re from kittysploit...