KindEditor 4.1.11 - Cross-Site Scripting Detection

KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. !/usr/bin/env python3 -- coding: utf-8 -- """KindEditor 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

elFinder 2.1.58 - Remote Code Execution Detection

elFinder 2.1.58 is impacted by multiple remote code execution vulnerabilities that could allow an attacker to execute arbitrary code and commands on the server hosting the elFinder PHP connector, even with minimal configuration. !/usr/bin/env python3 -- coding: utf-8 -- """elFinder 2.""" from...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting Detection

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress UserPro 4.9.32 - Cross-Site Scripting Detection

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress UserPro 4.""" from kittysploit import from...

WordPress a3 Lazy Load - Full Path Disclosure Detection

WordPress Plugin a3 Lazy Load plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin a3 Lazy Load plugin files are publicly...

WordPress Astra - Full Path Disclosure Detection

WordPress Astra Theme files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Astra Theme files are publicly accessible without ABSPATH protection...

WordPress Load More Anything - Full Path Disclosure Detection

WordPress Plugin Load More Anything files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Load More Anything files are publicly accessibl...

WordPress Advanced Responsive Video Embedder - Full Path Disclosure Detection

WordPress Advanced Responsive Video Embedder plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Responsive Video Embedder...

WordPress Plugin iThemes Security - Full Path Disclosure Detection

WordPress Plugin iThemes Security files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin iThemes Security files are publicly accessible...

Twig PHP <2.4.4 template engine - SSTI Detection

A vulnerability in Twig PHP allows remote attackers to cause the product to execute arbitrary commands via an SSTI vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Twig PHP allows remote attackers to cause the product to execute arbitrary commands via an .""" from...

Roundcube ≤ 1.6.10 Post-Auth RCE (CVE-2025-49113)

Authenticated RCE in Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11. Unsafe from handling in settings/upload.php allows PHP object deserialization via a CryptGPGEngine gadget command execution as the web server user. !/usr/bin/env python3 -- coding: utf-8 -- """Roundcube ≤ 1.6.10 post-au...

WordPress Elementor Pro - Full Path Disclosure Detection

WordPress Plugin Elementor Pro plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Elementor Pro plugin files are publicly...

WordPress Plugin Google Tag Manager - Full Path Disclosure Detection

WordPress Plugin Google Tag Manager files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Google Tag Manager files are publicly accessibl...

WordPress Duplicate Page - Full Path Disclosure Detection

WordPress Plugin Duplicate Page files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Duplicate Page files are publicly accessible withou...

WordPress Configuration wp-env - Exposure Detection

Detected the WordPress wp-env.json configuration file publicly accessible, potentially revealing the PHP version, installed plugins, themes, and development environment details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the WordPress wp-env.""" from kittysploit import from...

WordPress Menu Image - Full Path Disclosure Detection

WordPress Plugin Menu Image plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Menu Image plugin files are publicly accessible...

WordPress Joinchat - Full Path Disclosure Detection

WordPress Plugin Joinchat files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Joinchat files are publicly accessible without ABSPATH...

WordPress Twenty Sixteen - Full Path Disclosure Detection

WordPress Twenty Sixteen theme files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Twenty Sixteen theme files are publicly accessible without...