95594 matches found
Dahua Intelligent IoT - Information Disclosure Detection
There is a vulnerability in the user login interface /evo-apigw/evo-oauth/oauth/token of Zhejiang Dahua Technology Co., Ltd. Intelligent IoT Integrated Management Platform. Users can successfully log in to the platform using justForTest/any password, causing information leakage. !/usr/bin/env...
WP Directory Kit <= 1.4.4 - Authentication Bypass Detection
The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...
ClinicCases 7.3.3 Cross-Site Scripting Detection
ClinicCases 7.3.3 is susceptible to multiple reflected cross-site scripting vulnerabilities that could allow unauthenticated attackers to introduce arbitrary JavaScript by crafting a malicious URL. This can result in account takeover via session token theft. !/usr/bin/env python3 -- coding: utf-8...
Token Info Json File Detection
Detects Token Info Json File. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Token Info Json File.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Token Info Json File Detection', 'description': 'Detects Token...
OneDev < 4.0.3 - User Access Token Leak Detection
OneDev before version 4.0.3 contains an insecure endpoint that allows retrieval of arbitrary user details, including access tokens, due to missing security checks on /users/id, letting attackers leak sensitive data and impersonate users, exploit requires no special conditions. !/usr/bin/env pytho...
ATutor < 2.2.1 - Cross Site Scripting Detection
ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ATutor 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...
DbGate Anonymous Access - Detection
Detected DbGate instances that allowed anonymous access due to insecure default authentication settings, where unauthenticated users could obtain a valid JWT token and access database management APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected DbGate instances that allowed anonymous...
OAuth 2.0 Authorization Server Detection Template
Try to detect OAuth 2.0 Authorization Server via the "oauth/token" endpoint !/usr/bin/env python3 -- coding: utf-8 -- """Try to detect OAuth 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OAuth 2.0 Authorization...
Ruby on Rails Secret Token Disclosure Detection
Ruby on Rals Secret Token file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rals Secret Token file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ruby on Rails Secret Token Disclosure...
Joomla jMarket 5.15 - Cross-Site Scripting Detection
The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...
Talroo Jobs Script 1.0 - Cross-Site Scripting Detection
The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...
ArcGIS Token Service - Detect
Check for the existence of the ArcGIS Token Service on an ArcGIS server. !/usr/bin/env python3 -- coding: utf-8 -- """Check for the existence of the ArcGIS Token Service on an ArcGIS server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...
PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting Detection
The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...
Joomla JLex Review 6.0.1 - Cross-Site Scripting Detection
The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...
Dgraph <= 25.3.2 - Admin Token Disclosure Detection
Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...
CVE-2026-58337
A flaw was found in Moodle. The user homepage preference setting lacked a necessary token, making it vulnerable to a Cross-Site Request Forgery CSRF attack. A remote attacker could exploit this to trick a user into performing unwanted actions on the Moodle platform without their knowledge,...
CVE-2026-15012
The Demi – One Click Demo Import, WP Backup & Site Migration plugin for WordPress is vulnerable to Arbitrary Directory Copy in all versions up to, and including, 0.0.8 via the handlerestorestep function. This is due to missing HTTP access controls on the wp-content/uploads/demi-backup-state/...
EUVD-2026-49695
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-16587
The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
