ConnectWise Setup Wizard - Exposure Detection

Detects ConnectWise Setup Wizard - Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ConnectWise Setup Wizard - Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ConnectWise Setup Wizard - Exposu...

CubeBackup Setup Page - Exposure Detection

Detects exposed CubeBackup Setup page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed CubeBackup Setup page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CubeBackup Setup Page - Exposure Detection',...

Atlassian Confluence CVE-2023-22515 Detection

Detects CVE-2023-22515 by verifying that setupComplete can be toggled to re-expose the administrator setup form no account creation. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Confluence CVE-2023-22515 broken access control / setup reset detection.""" from kittysploit import from...

AnythingLLM - Information Disclosure Detection

AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. If AnythingLLM prior to version 1.10.0 is configured to use Qdrant as the vector database with an API key, this QdrantApiKey could be exposed in plain text to unauthenticate...

FleetCart Installation Page - Exposure Detection

Detects exposed FleetCart setup installation pages which could allow unauthorized access or information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed FleetCart setup installation pages which could allow unauthorized access or information disclo.""" from kittysploit impo...

FusionAuth Exposed Admin Setup Detection

FusionAuth Admin Setup is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """FusionAuth Admin Setup is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FusionAuth Exposed Admin Setup Detection',...

JustFans Installation Page - Exposure Detection

Detects exposed JustFans Setup page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed JustFans Setup page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JustFans Installation Page - Exposure Detection',...

Zenphoto <1.5 Installer - Detect

Zenphoto setup page before version 1.5 is susceptible to sensitive information disclosure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Zenphoto setup page before version 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Zipline - Installer Detection

Zipline installer setup was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zipline installer setup was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zipline - Installer Detection', 'description':...

Wiki.js Setup - Exposure Detection

Checks for the presence of a Wiki.js Setup Page. !/usr/bin/env python3 -- coding: utf-8 -- """Checks for the presence of a Wiki.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wiki.js Setup - Exposure Detection',...

TOTOLINK Installer - Exposure Detection

Detects the presence of TOTOLINK router setup pages at /wizardset.htm and /easysetup.htm. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of TOTOLINK router setup pages at /wizardset.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Uptime Kuma - Installer Detection

Detected Uptime Kuma setup page is publicly accessible with needSetup enabled, allowing unauthenticated users to complete installation and gain full admin access by access /setup-database. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Uptime Kuma setup page is publicly accessible with...

StrongShop Installer - Exposure Detection

Detects the exposure of the StrongShop installer page, which could allow unauthorized setup or reinstallation of the application. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the exposure of the StrongShop installer page, which could allow unauthorized setup or reinstallation .""" from...

Setup GitHub Enterprise - Detect

Detects Setup GitHub Enterprise - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Setup GitHub Enterprise - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Setup GitHub Enterprise - Detect',...

Multilaser Pro Setup Page - Detect

This allows the user to access quick setup settings and configuration page through /wizard.htm. !/usr/bin/env python3 -- coding: utf-8 -- """This allows the user to access quick setup settings and configuration page through /wizard.""" from kittysploit import from lib.protocols.http.httpclient...

Metabase Installer - Exposure Detection

Detected Metabase installer page, allowing unauthorized database setup and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Metabase installer page, allowing unauthorized database setup and configuration.""" from kittysploit import from lib.protocols.http.httpclient import...

O2 Router Setup Panel - Detect

O2 router setup panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """O2 router setup panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'O2 Router Setup Panel - Detect', 'description': 'O2...

CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-18028 Missing authorization check in event quick setup view

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-18028

CVE-2026-18028 describes a missing authorization check in the "+quick setup+" view presented after creating an event. The flaw allows an attacker to send well-timed requests to perform privileged actions on events the user should not access, including creating products, quotas, configuring bank t...