EpiServer Find <13.2.7 - Open Redirect Detection

EpiServer Find before 13.2.7 contains an open redirect vulnerability via the tredirect parameter in a crafted URL, such as a /findv2/click URL. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations...

ListingPro < 2.6.1 - Sensitive Data Disclosure Detection

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Sensitive Data Exposure in versions before 2.6.1 via the /listingpro-plugin/functions.php file. This makes it possible for unauthenticated attackers to extract sensitive data including usernames, full names, email...

OpenText Documentum Administrator 7.2.0180.0055 - Open Redirect Detection

OpenText Documentum Administrator 7.2.0180.0055 is susceptible to multiple open redirect vulnerabilities. An attacker can redirect a user to a malicious site and potentially obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -...

WordPress JSmol2WP <=1.07 - Local File Inclusion Detection

WordPress JSmol2WP plugin 1.07 is susceptible to local file inclusion via ../ directory traversal in query=php://filter/resource= in the jsmol.php query string. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context...

Cisco SD-WAN vManage Software - Local File Inclusion Detection

Cisco SD-WAN vManage Software in the application data endpoints is vulnerable to local file inclusion which could allow an unauthenticated, remote attacker to gain access to sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco SD-WAN vManage Software in the application data...

Processwire CMS <2.7.1 - Local File Inclusion Detection

Processwire CMS prior to 2.7.1 is vulnerable to local file inclusion because it allows a remote attacker to retrieve sensitive files via the download parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """Processwire CMS prior to 2.""" import re from kittysploit import from...

Bitbucket Server > 4.8 - Authentication Bypass Detection

There is a permission bypass vulnerability through %20, which allows arbitrary users to obtain sensitive data !/usr/bin/env python3 -- coding: utf-8 -- """There is a permission bypass vulnerability through %20, which allows arbitrary users to obtain sensitive data.""" from kittysploit import from...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure Detection

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...

Puppet Server/PuppetDB - Sensitive Information Disclosure Detection

Puppet Server and PuppetDB provide useful performance and debugging information via their metrics API endpoints, which may contain sensitive information when left exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Puppet Server and PuppetDB provide useful performance and debugging information...

WAVLINK WN535 G3 - Improper Access Control Detection

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...

perfSONAR 4.x <= 4.4.4 - Server-Side Request Forgery Detection

An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery SSRF attacks. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in the graphData.""" from kittysploit import from lib.protocols.http.httpclie...

AccessAlly <3.5.7 - Sensitive Information Leakage Detection

WordPress AccessAlly plugin before 3.5.7 allows sensitive information leakage because the file "resource/frontend/product/product-shortcode.php" which is responsible for the accessallyorderform shortcode dumps serialize$SERVER, which contains all environment variables. The leakage occurs on all...

Barco Control Room Management Suite <=2.9 Build 0275 - Local File Inclusion Detection

Barco Control Room Management through Suite 2.9 Build 0275 is vulnerable to local file inclusion that could allow attackers to access sensitive information and components. Requests must begin with the "GET /...." substring. !/usr/bin/env python3 -- coding: utf-8 -- """Barco Control Room Managemen...

WordPress Simple Ajax Chat <20220116 - Sensitive Information Disclosure vulnerability Detection

WordPress Simple Ajax Chat before 20220216 is vulnerable to sensitive information disclosure. The plugin does not properly restrict access to the exported data via the sac-export.csv file, which could allow unauthenticated users to access it. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

Download Monitor <= 4.7.60 - Sensitive Information Exposure Detection

The Download Monitor plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.7.60 via REST API. This can allow unauthenticated attackers to extract sensitive data including user reports, download reports, and user data including email, role, id and...

DedeCMS 5.7.87 - Directory Traversal Detection

Directory traversal vulnerability in DedeCMS 5.7.87 allows reading sensitive files via the $activepath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Directory traversal vulnerability in DedeCMS 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Plugin dzs zoomsounds Detection

Searches for sensitive directories present in the dzs-zoomsounds plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the dzs-zoomsounds plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

KubeOperator Foreground `kubeconfig` - File Download Detection

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator versions 3.16.3 and below, API interfaces with unauthorized entities and can leak sensitive information. This vulnerability could be used t...

WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing Detection

FastDup WordPress plugin 2.2 contains a directory listing vulnerability caused by lack of access restrictions in sensitive directories, letting attackers view export files, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """FastDup WordPress plugin 2.""" from...

Avada < 7.11.7 - Information Disclosure Detection

The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. This makes it possible for unauthenticated attackers to extract sensitive data uploaded via an Avada created form with ...