Mr.SIP — Updated!

SIP Security, Attack and Audit Framework Mr.SIP is a simple, console-bas...

CVE-2026-8794 PaperCut NG/MF: User enumeration via timing attack

PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a...

CVE-2026-16291 ProfileGrid < 5.9.9.8 - Subscriber+ Arbitrary Notification Deletion via IDOR

The ProfileGrid WordPress plugin before 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it, allowing any authenticated user such as a Subscriber to delete other users' notifications by enumerating notification identifiers...

GHSA-JHH7-832H-F8HV WPGraphQL has deprecated `user` field on SendPasswordResetEmailPayload that leaks user existence + profile (defeats explicit anti-enumeration design)

Summary The sendPasswordResetEmail mutation in WPGraphQL is explicitly designed to prevent user enumeration. The resolver in src/Mutation/SendPasswordResetEmail.php states in a code comment: // We obsfucate the actual success of this mutation to prevent user enumeration. The mutation always retur...

PT-2026-66713

The JS Help Desk WordPress plugin before 3.1.4 grants a support-agent capability to the Contributor role on activation and does not perform a capability check on a user-listing handler, allowing Contributor-level users to enumerate the email addresses of all registered WordPress users...

Siemens SIMATIC Observable Discrepancy (CVE-2023-37482)

The webserver of several SIMATIC products is affected by a user enumeration vulnerability that could allow an unauthenticated remote attacker to identify valid usernames. The login functionality of the web server in affected devices does not normalize the response times of login attempts. An...

WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting Detection

WordPress Stop User Enumeration 1.3.7 and earlier are vulnerable to unauthenticated reflected cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Stop User Enumeration 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

GitLab GraphQL API User Enumeration Detection

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, nam.""" fr...

Thinfinity VirtualUI User Enumeration Detection

Thinfinity VirtualUI before v3.0, /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users Administrator, Guest, etc. !/usr/bin/env python3 -- coding: utf-8 -- """Thinfinity VirtualUI before v3.""" import re from kittysploit impo...

Drupal User Enumeration [Redirect] Detection

Detects Drupal User Enumeration Redirect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Drupal User Enumeration Redirect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Drupal User Enumeration...

Drupal User Enumration [Ajax] Detection

Detects Drupal User Enumration Ajax. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Drupal User Enumration Ajax.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Drupal User Enumration Ajax Detection',...

iTop - User Enumeration via REST Endpoint Detection

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. !/usr/bin/env python3 -- coding: utf-8 --...

Wordpress RDF User Enumeration Detection

Leaked Wordpress RDF leads to User Emumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked Wordpress RDF leads to User Emumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress RDF User...

Gitea - User Enumeration Detection

Enumerates the users registered in the Gitea web application, a self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD. !/usr/bin/env python3 -- coding: utf-8 -- """Enumerates the users registered in the Gitea web...

Jenkins Users - Exposure Detection

Detected an exposed Jenkins asynchPeople endpoint that discloses user information e.g., users, full names, and profile URLs allowing user enumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed Jenkins asynchPeople endpoint that discloses user information e.""" from...

Wordpress User Enumeration Detection

This template detects user enumeration in wordpress. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects user enumeration in wordpress.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpre...

CredSpy v1.1.0

CredSpy Enumerate Microsoft Entra ID authentication methods for email addresses using the public GetCredentialType API. This is the same endpoint the Microsoft login page uses when you enter a username. In contrast to most tools using the GetCredentialType method, CredSpy also shows the...

CVE-2025-59178

Ericsson Packet Core Controller PCC versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system...

CVE-2025-59178

CVE-2025-59178 affects Ericsson Packet Core Controller (PCC) prior to 1.39. The vulnerability arises in Configuration Management, exposing sensitive system information that allows an attacker to enumerate other users on the system. According to the CVSS metrics, the impact is primarily on confide...

CVE-2025-59178

Ericsson Packet Core Controller PCC versions prior to 1.39 contain an Exposure of Sensitive System Information vulnerability in Configuration Management allowing an attacker to enumerate other users on the system...