PHP Debug Bar Enabled

The web application on the remote server has a PHP debug bar which is accessible without protection. A remote attacker can exploit this to gain more knowledge about the host, allowing an attacker to conduct further attacks. No source data...

Roxy-WI < 6.1.1.0 Remote Code Execution

Roxy-WI is an open source Graphical User Interface GUI for managing HAProxy, Nginx, Apache and Keepalived servers. Roxy-WI versions before 6.1.1.0 suffer does not properly sanitize the ipbackend parameter on the /app/options.py endpoint, allowing a remote and unauthenticated attacker to achieve a...

HTML Comments Detected

HTML comments are often used by developers to include information related to the application inline, which are ignored by a clients browser during rendering. These comments may include sensitive information such as SQL queries, credentials or internal IP for example. No source data...

GeoServer SQL Injection

The GeoServer instance installed on the remote host is affected by a SQL injection vulnerability due to improper sanitization through an OGC Common Query Language query. No source data...

GoCD Information Disclosure

ThoughtWorks GoCD is an open source continuous integration and development software CI/CD used to build, deploy and test software projects. GoCD versions 20.6.x to 21.2.0 suffer from an information disclosure in its business continuity add-on. A remote and unauthenticated attacker can leverage th...

CKAN < 2.8.12 Shared Session Secret

The version of CKAN installed can be impacted by a shared session secret if the application is based on one of the CKAN Docker images and if the users didn't set a custom value via an environment variable. Note that the scanner has not tested for these issues but has instead relied only on the...

ActivityPub Protocol Detected

A ActivityPub json endpoint has been detected and is available as an attachment below. ActivityPub is a W3C recomended standard that provides a client to server API for creating, updating and deleting content, as well as a federated server to server API for delivering notifications and subscribin...

Joomla Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed Joomla plugins. No source data...

Drupal Plugins Detected

This is an informational notice that the scanner was able to detect one or more installed Drupal plugins. No source data...

Fortra GoAnywhere MFT < 7.1.2 Remote Code Execution

Fortra GoAnywhere MFT is a Managed File Transfer MFT solution helping organizations build both internal and external data transfer exchanges. GoAnyWhere MFT versions before 7.1.2 suffer from a deserialization vulnerability in the LicenseResponse servlet. By crafting a specific serialized object, ...

CVE-2023-32321 CKAN remote code execution and private information access via crafted resource ids

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in resourcecreate and packageupdate actions, using the ResourceUploader object. Also...

CraftCMS Administration Panel Login Form Detected

CraftCMS Administration Panel has been detected on the target web application. This may present an attacker with an exploit vector which could be leveraged using other techniques, such as a Brute-Force or Dictionary Attack, allowing an attacker to gain access to administrative functionality. No...

CraftCMS User Enumeration

In default CraftCMS installation there is available methodology to enumerate user information. These CraftCMS users may then be used in brute-force attacks against CraftCMS login page to guess passwords. No source data...

Pprof Debug Files Detected

Pprof is a tool for visualization and analysis of profiling data. Output files may be located inside a hidden directory named debug/pprof/ & When exposed with the web application configuration, the files contained in this directory may expose sensitive information such as internal memory addresse...

MinIO Information Disclosure

MinIO is a multi-cloud and open-source object storage framework. When deployed in cluster mode, MinIO versions starting with RELEASE.2021-08-31T05-46-54Z and prior to RELEASE.2023-0320T20-16-18Z suffer from an information disclosure vulnerability, exposing all environment variables, including...

CraftCMS DevMode Enabled

CraftCMS installed on the remote host is configured to operate in development mode devMode. While this environment can help speed up development of web applications, it can leak information about the underlying web applications. No source data...

WP Show Posts Plugin for WordPress < 1.1.4 Cross-Site Scripting

The WordPress WP Show Posts Plugin installed on the remote host is affected by a cross-site scripting vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

AtroCore 代码问题漏洞

AtroCore is an open source data platform, data management and middleware software from AtroCore, Inc. A security vulnerability exists in AtroCore version 1.5.25 that stems from the presence of an unauthenticated file upload vulnerability...

Qwik < 0.21.0 Code Injection

Qwik in version 0.21.0 provides an extended serialization mechanism for exchanging data between the client and server. Through a specially crafted request on the endpoint /q-data.json, an unauthenticated attacker is able to inject code and execute arbitrary commands No source data...

Apache Tomcat 8.5.x < 8.5.86 Information Disclosure

The version of Apache Tomcat installed on the remote host is 8.5.x prior to 8.5.86, 9.0.0-M1 prior to 9.0.72, 10.1.0-M1 prior to 10.1.6 or 11.0.0-M1 prior to 11.0.0-M3. It is, therefore, affected by an information disclosure due to the RemoteIpFilter. Note that the scanner has not attempted to...