CVE-2026-49332

A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys X-Forwarded-User but does not strip underscore-variant keys XForwardedUser from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing a...

urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via ProxyManager.connectionfromurl.urlopen with assertsamehost=False, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitiv...

Mailpit < 1.28.3 - Server-Side Request Forgery Detection

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """Mailpi...

Artica Proxy 4.30.000000 - Cross-Site Scripting Detection

Artica Proxy 4.30.000000 contains a cross-site scripting vulnerability via the password parameter in /fw.login.php. !/usr/bin/env python3 -- coding: utf-8 -- """Artica Proxy 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OpenShift OAuth Proxy - Panel Detect

Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login page content. Checks both the default port and port 9001. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login pa...

Nginx Proxy Manager Login Panel - Detect

Nginx Proxy Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx Proxy Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Proxy Manager Login Panel...

Java FTP Proxy Service - Detect

Java FTP Proxy service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Java FTP Proxy service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Java FTP Proxy...

Artica Web Proxy Detect

Detects Artica Web Proxy Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Artica Web Proxy Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Artica Web Proxy Detect', 'description': 'Detects Artica...

SAP Web Dispatcher detection

Detection of SAP Web Dispatcher service !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP Web Dispatcher service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAP Web Dispatcher detection',...

Onair2 < 3.9.9.2 & KenthaRadio < 2.0.2 - Remote File Inclusion/Server-Side Request Forgery Detection

Onair2 3.9.9.2 and KenthaRadio 2.0.2 have exposed proxy functionality to unauthenticated users. Sending requests to this proxy functionality will have the web server fetch and display the content from any URI, allowing remote file inclusion and server-side request forgery. !/usr/bin/env python3 -...

Geoserver - Server-Side Request Forgery Detection

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer through 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Apache Tomcat JK Connect <=1.2.44 - Manager Access Detection

Apache Tomcat JK modjk Connector 1.2.0 to 1.2.44 allows specially constructed requests to expose application functionality through the reverse proxy. It is also possible in some configurations for a specially constructed request to bypass the access controls configured in httpd. While there is so...

Jolokia Agent - JNDI Code Injection Detection

Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote attacker to run arbitrary Java code on the server when the agent is in proxy mode. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia agent is vulnerable to a JNDI injection vulnerability that allows a remote...

PHP Proxy 3.0.3 - Local File Inclusion Detection

PHP Proxy 3.0.3 is susceptible to local file inclusion vulnerabilities that allow unauthenticated users to read files from the server via index.php?q=file:/// a different vulnerability than CVE-2018-19246. !/usr/bin/env python3 -- coding: utf-8 -- """PHP Proxy 3.""" import re from kittysploit...

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery Detection

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication. !/usr/bin/env python3 -- coding...

X-Proxy Dashboard Panel - Detect

X-Proxy Dashboard panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """X-Proxy Dashboard panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'X-Proxy Dashboard Panel - Detect', 'description...

Tinyproxy - Detect

Lightweight HTTP/HTTPS proxy daemon for POSIX operating systems !/usr/bin/env python3 -- coding: utf-8 -- """Lightweight HTTP/HTTPS proxy daemon for POSIX operating systems.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

PHP Proxy Detect

Detects PHP Proxy Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PHP Proxy Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP Proxy Detect', 'description': 'Detects PHP Proxy Detect.', 'author'...

Retool < 3.88 - SVG Cross-Site Scripting Detection

This template checks for SVG Cross-Site ScriptingXSS vulnerability via the Image Proxy URL parameter in Retool. !/usr/bin/env python3 -- coding: utf-8 -- """This template checks for SVG Cross-Site ScriptingXSS vulnerability via the Image Proxy URL parameter in Reto.""" from kittysploit import fro...

LiteLLM Proxy - Model Exposure Detection

LiteLLM proxy was detected with anonymous access to the model listing API. LiteLLM proxies that ship without generalsettings.masterkey or with the key disabled expose the configured upstream model catalog via /v1/models and /model/info — revealing which OpenAI / Anthropic / Azure / Bedrock /...