Buffalo WSR-2533DHPL2 - Path Traversal Detection

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo...

Aquatronica Controller System <= 5.1.6 - Information Disclosure Detection

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

HP LaserJet Configuration Exposure Detection

HP LaserJet printer web interface exposes sensitive configuration information without authentication.This includes device information, network configuration, SNMP settings, and other sensitive data that could be leveraged for further attacks or network reconnaissance. !/usr/bin/env python3 --...

Wing FTP 6.4.4 - Cross-Site Scripting Detection

Wing FTP 6.4.4 is vulnerable to cross-site scripting via its web interface because an arbitrary IFRAME element can be included in the help pages via a crafted link, leading to the execution of sandboxed arbitrary HTML and JavaScript in the user's browser. !/usr/bin/env python3 -- coding: utf-8 --...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

Cisco Unified Communications Manager 7/8/9 - Directory Traversal Detection

A directory traversal vulnerability in the Tomcat administrative web interface in Cisco Unified Communications Manager allows remote authenticated users to read arbitrary files via directory traversal sequences in an unspecified input string, aka Bug ID CSCui78815 !/usr/bin/env python3 -- coding:...

SV3C HD Camera L Series - Open Redirect Detection

SV3C HD Camera L Series 2.3.4.2103-S50-NTD-B20170508B and 2.3.4.2103-S50-NTD-B20170823B contains an open redirect vulnerability. It does not perform origin checks on URLs in the camera's web interface, which can be leveraged to send a user to an unexpected endpoint. An attacker can possibly obtai...

Allied Telesis AT-GS950/8 - Local File Inclusion Detection

Allied Telesis AT-GS950/8 until Firmware AT-S107 V.1.1.3 is susceptible to local file inclusion via its web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Allied Telesis AT-GS950/8 until Firmware AT-S107 V.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Powertek Firmware <3.30.30 - Authorization Bypass Detection

Powertek firmware multiple brands before 3.30.30 running Power Distribution Units are vulnerable to authorization bypass in the web interface. To exploit the vulnerability, an attacker must send an HTTP packet to the data retrieval interface /cgi/getparam.cgi with the tmpToken cookie set to an...

ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure Detection

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

Echelon i.LON SmartServer - Login Panel Detection

Echelon now Adesto/Dialog Semiconductor i.LON SmartServer is a LonWorks/IP-852 building automation controller used in HVAC, lighting, and energy management systems. The embedded web interface is frequently exposed on standard and non-standard ports. !/usr/bin/env python3 -- coding: utf-8 --...

AnythingLLM Panel Detection

Detects AnythingLLM personal LLM web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AnythingLLM panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AnythingLLM Panel Detection", "description":...

Adiscon LogAnalyzer - Information Disclosure Detection

Adiscon LogAnalyzer was discovered. Adiscon LogAnalyzer is a web interface to syslog and other network event data. It provides easy browsing and analysis of real-time network events and reporting services. !/usr/bin/env python3 -- coding: utf-8 -- """Adiscon LogAnalyzer was discovered.""" from...

Copyparty v1.8.6 - Cross-Site Scripting Detection

Copyparty is a portable file server. Versions prior to 1.8.6 are subject to a reflected cross-site scripting XSS Attack. The vulnerability in the application's web interface could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link. !/usr/bin/e...

Windows Admin Center Panel - Detection

Detect Windows Admin Center Panel web interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Windows Admin Center Panel web interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Windows Admin Center Pane...

NTFY Web - Exposure Detection

Publicly exposed NTFY web interface allowing unauthorized publish or subscribe access. !/usr/bin/env python3 -- coding: utf-8 -- """Publicly exposed NTFY web interface allowing unauthorized publish or subscribe access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Raritan PDU - Login Panel Detection

Raritan intelligent PDU web interface panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Raritan intelligent PDU web interface panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

SABnzbd - Unauthenticated Web Interface Access Detection

Detected SABnzbd found with the web interface accessible without authentication. The config page is exposed without login, leaking the API key, config file path, server parameters, and system information to unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SABnzbd found...

SEL Real-Time Automation Controller - Login Panel Detection

Schweitzer Engineering Laboratories SEL Real-Time Automation Controller RTAC is a programmable automation controller used in electric utility and industrial automation environments for protection, control, and automation. The web interface exposes a management panel for configuration and...

OpenCode Web - Unauthenticated Access Detection

Unauthenticated network access to the OpenCode web interface was detected. When the OpenCode web server is started without setting the OPENCODESERVERPASSWORD environment variable, the server is completely unsecured. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated network access to th...