MapTiler Tileserver-php v2.0 - Unauthenticated XSS Detection

MapTiler Tileserver-php v2.0 contains a reflected XSS caused by unencoded reflection of the GET parameter "layer" in an error message, letting unauthenticated attackers execute arbitrary script on victim browsers. !/usr/bin/env python3 -- coding: utf-8 -- """MapTiler Tileserver-php v2.""" from...

Duplicator < 1.4.7.1 - Information Disclosure Detection

The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site. !/usr/bin/env python3 -- coding: utf-8 -- """The Duplicator WordPress plugin before...

Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion Detection

Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """Portal do Software Publico Brasileiro i3geo 7."""...

PMB v7.4.6 - Cross-Site Scripting Detection

PMB v7.4.6 allows an attacker to perform a reflected XSS on exportz3950.php via the 'query' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PMB v7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PMB v7.4.6 -...

PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier...

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting Detection

PhpJabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting XSS via the keyword parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PhpJabbers PHP Forum Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion Detection

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

My Geo Posts Free <= 1.2 - PHP Object Injection Detection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

Php-mod/curl Library <2.3.2 - Cross-Site Scripting Detection

Php-mod/curl library before 2.3.2 contains a cross-site scripting vulnerability via the postfilepathupload.php key parameter and the POST data to postmultidimensional.php. An attacker can inject arbitrary script, which can allow theft of cookie-based authentication credentials and launch of other...

Shirne CMS 1.2.0 - Local File Inclusion Detection

Shirne CMS 1.2.0 is vulnerable to local file inclusion which could cause arbitrary file read via /static/ueditor/php/controller.php. !/usr/bin/env python3 -- coding: utf-8 -- """Shirne CMS 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Arcade.php - SQL Injection Detection

The arcade.php script is vulnerable to SQL injection. By exploiting this vulnerability, an attacker can manipulate the SQL queries executed by the script, potentially gaining unauthorized access to the database. !/usr/bin/env python3 -- coding: utf-8 -- """The arcade.""" from kittysploit import...

MAMP - PHP Info Exposure Detection

Detected MAMP server was exposed phpinfo page, revealing sensitive PHP configuration, server paths, and environment variables. !/usr/bin/env python3 -- coding: utf-8 -- """Detected MAMP server was exposed phpinfo page, revealing sensitive PHP configuration, server paths, and envi.""" from...

Php Debug Bar - Exposure Detection

The DebugBar integrates easily into projects and can display profiling data from any part of your application.This template detects exposed PHP Debug Bars by looking for known response bodies and the phpdebugbar-id in headers. !/usr/bin/env python3 -- coding: utf-8 -- """The DebugBar integrates...

PHP-FPM Configuration Page - Detect

PHP-FPM configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-FPM configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP-FPM Configuration Page - Detect',...

PHP Proxy Detect

Detects PHP Proxy Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP Proxy Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Proxy Detect', 'description': 'Detects PHP Proxy Detect.', 'author'...

PEAR Registry Files Exposed Detection

Detected exposed PEAR registry files .reg containing serialized PHP metadata, including package versions and local paths. This exposure facilitated supply-chain reconnaissance by revealing installed dependencies and system mappings. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed PE...

PHP IPAM Installation Page - Exposed Detection

PHP IPAM is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """PHP IPAM is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Php User.ini Disclosure Detection

PHP user.ini file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP user.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Php User.ini Disclosure Detection', 'description': 'PHP user.ini file is exposed.',...

MyBB - Full Path Disclosure Detection

Detected MyBB forum software exposed the server's full filesystem path through PHP fatal errors when files that implemented interfaces were accessed without dependencies. !/usr/bin/env python3 -- coding: utf-8 -- """Detected MyBB forum software exposed the server's full filesystem path through PH...

PHP_CodeSniffer Configuration Exposure - Detect

PHPCodeSniffer configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PHPCodeSniffer configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHPCodeSniffer Configuratio...