DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...

Glimpse Diagnostics - Sensitive Data Exposure Detection

Detected Glimpse diagnostics endpoint. Glimpse is a .NET diagnostics tool that reveals detailed request information, server configuration, SQL queries, connection strings, and session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Glimpse diagnostics endpoint.""" from kittysploit...

ELMAH Exposure Detection

ELMAH Error Logging Modules and Handlers is an application-wide error logging facility that is completely pluggable. It can be dynamically added to a running ASP.NET web application, or even all ASP.NET web applications on a machine, without any need for re-compilation or re-deployment. In some...

Joomla jMarket 5.15 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scriptin...

PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

JavaMelody Monitoring Exposed Detection

JavaMelody is a tool used to monitor Java or Java EE applications in QA and production environments. JavaMelody was detected on this web application. One option in the dashboard is to "View http sessions". This can be used by an attacker to steal a user's session. !/usr/bin/env python3 -- coding:...

Tongda User Session Disclosure Detection

Tongda User session exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Tongda User session exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tongda User Session Disclosure Detection', 'description': 'Tongda...

Talroo Jobs Script 1.0 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

ChatGPT Web - Unauthorized Access Detection

ChatGPT Web is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """ChatGPT Web is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChatGPT Web - Unauthorized Access Detection', 'description': 'ChatGPT Web i...

ChurchCRM Panel - Detect

ChurchCRM panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """ChurchCRM panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ChurchCRM Panel - Detect', 'description': 'ChurchCRM panel...

McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting Detection

McAfee Network Data Loss Prevention User-Agent 9.3.x contains a cross-site scripting vulnerability which allows remote attackers to get session/cookie information via modification of the HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """McAfee Network Data Loss Prevention User-Agent 9.""...

ChurchCRM - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter in /session/begin. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability was discovered in ChurchCRM via the 'username' parameter .""" from...

PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting Detection

A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be executed remote...

YesWiki < 4.5.4 - Cross-Site Scripting Detection

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki 4.""" from kittysploit...

GLPI - Directory Listing and Session Exposure Detection

Detected GLPI directory listing exposed sensitive files and PHP session data, potentially allowing session hijacking or information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detected GLPI directory listing exposed sensitive files and PHP session data, potentially allowing session...

OpenVPN Access Server - Configuration Exposure Detection

Detected OpenVPN Access Server with sensitive configuration data exposed, including VPN client profiles, certificates, private keys, and session tokens, without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected OpenVPN Access Server with sensitive configuration data exposed,...

Joomla JLex Review 6.0.1 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...