PHP Fusion Detect

Detects PHP Fusion Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP Fusion Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Fusion Detect', 'description': 'Detects PHP Fusion Detect.',...

PHP Prober - Exposure Detection

PHP Prober Server exposure was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Prober Server exposure was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Prober - Exposure Detection',...

PHP Composer Binary - Exposure Detection

This Nuclei template checks if the specified endpoints have publically accessible PHP Composer Binary. !/usr/bin/env python3 -- coding: utf-8 -- """This Nuclei template checks if the specified endpoints have publically accessible PHP Composer Binary.""" from kittysploit import from...

PHP-CS-Fixer Cache - File Disclosure Detection

PHP CS fixer cache internal file is disclosed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP CS fixer cache internal file is disclosed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP-CS-Fixer Cache - File...

PHP End-of-Life - Detect

Detected PHP versions that have reached End-of-Life EOL and no longer receive security updates. !/usr/bin/env python3 -- coding: utf-8 -- """Detected PHP versions that have reached End-of-Life EOL and no longer receive security updates.""" from kittysploit import from lib.protocols.http.httpclien...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

FUEL CMS 1.4.1 - Remote Code Execution Detection

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

PhpMyAdmin Scripts - Remote Code Execution Detection

PhpMyAdmin Scripts 2.11.x before 2.11.9.5 and 3.x before 3.1.3.1 are susceptible to a remote code execution in setup.php that allows remote attackers to inject arbitrary PHP code into a configuration file via the save action. Combined with the ability to save files on server, this can allow...

WordPress Plugin DukaPress 2.5.2 - Directory Traversal Detection

A directory traversal vulnerability in the dpimgresize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the src parameter to lib/dpimage.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Joomla! Component Visites 1.1 - MosConfig_absolute_path Remote File Inclusion Detection

A PHP remote file inclusion vulnerability in core/include/myMailer.class.php in the Visites comjoomla-visites component 1.1 RC2 for Joomla! allows remote attackers to execute arbitrary PHP code via a URL in the mosConfigabsolutepath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A PHP...

WordPress UserPro 4.9.32 - Cross-Site Scripting Detection

WordPress UserPro 4.9.32 is vulnerable to reflected cross-site scripting because the Instagram PHP API v2 it relies on allows it via the example/success.php errordescription parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress UserPro 4.""" from kittysploit import from...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

WP Hotel Booking < 1.10.4 - PHP Object Injection Detection

The wp-hotel-booking plugin through 1.10.2 for WordPress allows remote attackers to execute arbitrary code because of an unserialize operation on the thimpresshotelbooking1 cookie in load in includes/class-wphb-sessions.php. !/usr/bin/env python3 -- coding: utf-8 -- """The wp-hotel-booking plugin...

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting Detection

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Mailster <=1.5.4 - Cross-Site Scripting Detection

WordPress Mailster 1.5.4 and before contains a cross-site scripting vulnerability in the unsubscribe handler via the mes parameter to view/subscription/unsubscribe2.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Mailster 1.""" from kittysploit import from lib.protocols.http.httpclien...

HotelDruid 2.3.0 - Cross-Site Scripting Detection

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. !/usr/bin/env python3 -- coding: utf-8 -- """HotelDruid 2.""" from kittysploit import from...

shadoweb wdja v1.5.1 - Cross-Site Scripting Detection

shadoweb wdja v1.5.1 is susceptible to cross-site scripting because it allows attackers to execute arbitrary code and gain escalated privileges via the backurl parameter to /php/passport/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """shadoweb wdja v1.""" from kittysploit import from...

uWSGI PHP Plugin Local File Inclusion Detection

uWSGI PHP Plugin before 2.0.17 mishandles a DOCUMENTROOT check during use of the --php-docroot option, making it susceptible to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """uWSGI PHP Plugin before 2.""" import re from kittysploit import from lib.protocols.http.httpclient...

Zeta Producer Desktop CMS <14.2.1 - Local File Inclusion Detection

Zeta Producer Desktop CMS before 14.2.1 is vulnerable to local file inclusion if the plugin "filebrowser" is installed because of assets/php/filebrowser/filebrowser.main.php?file=../ directory traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Zeta Producer Desktop CMS before 14.""" import r...

KindEditor 4.1.11 - Cross-Site Scripting Detection

KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. !/usr/bin/env python3 -- coding: utf-8 -- """KindEditor 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...