Atlassian Jira Server/Data Center <8.5.8/8.6.0 - 8.11.1 - Information Disclosure Detection

Atlassian Jira Server and Data Center before 8.5.8 and 8.6.0 through 8.11.1 are susceptible to information disclosure via the /secure/QueryComponent!Default.jspa endpoint. An attacker can view custom field names and custom SLA names. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Jira...

Easy FancyBox - Full Path Disclosure Detection

Easy FancyBox WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Easy FancyBox WordPress plug...

XWiki Platform - Path Traversal Detection

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform 4.""" from...

GE Proficy WebSpace - Login Panel Detection

GE Proficy WebSpace is a thin-client delivery platform for GE Proficy HMI/SCADA iFIX, CIMPLICITY applications over the web. It exposes industrial HMI screens via browser on TCP/491 by default. The Server header "WebSocket++/0.7.0" is a unique indicator. !/usr/bin/env python3 -- coding: utf-8 --...

Fortinet FortiNAC Login Panel - Detect

Fortinet FortiNAC login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiNAC login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiNAC Login Panel -...

Apache Kafka Broker Detection

Detects Kafka brokers by sending an ApiVersions request on TCP 9092. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Apache Kafka brokers via ApiVersions on TCP 9092.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.kafka.detectors...

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization Detection

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. !/usr/bin/env python3 -- coding: utf-8 --...

SonicWall SRA 4600 VPN - SQL Injection Detection

The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The SonicWall SRA 4600 VPN appliance is susceptible to a pre-authentication SQL injection vulnerability.""" from kittysploit import from...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe Coldfusion versions 2016 update 16 and earlier, 2018 update 10 and earlier and 2021.0.0.323925 are affected by an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. An attacker could abuse this vulnerability to execute arbitrary JavaScript code...

ZZcms - Cross-Site Scripting Detection

ZZcms 2019 contains a cross-site scripting vulnerability in the user login page. An attacker can inject arbitrary JavaScript code in the referer header via user/login.php, which can allow theft of cookie-based credentials and launch of subsequent attacks. !/usr/bin/env python3 -- coding: utf-8 --...

SAP NetWeaver AS JAVA 7.30-7.50 - Remote Admin Addition Detection

SAP NetWeaver AS JAVA LM Configuration Wizard, versions 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java system, including the ability to create an...

VMware Workspace ONE UEM Airwatch Login Panel - Detect

VMware Workspace ONE UEM Airwatch login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Workspace ONE UEM Airwatch login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting Detection

WordPress Easy Pricing Tables plugin before 3.2.1 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter before reflecting it back in a page available to any user both authenticated and unauthenticated when a specific setting is enabled. !/usr/bin/env...

Yearning - Directory Traversal Detection

Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning. !/usr/bin/env python3 -- coding: utf-8 -- """Yearning has a directory traversal vulnerability that can be exploited b...

Froxlor < 0.10.38.2. - HTML Injection Detection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. !/usr/bin/env python3 -- coding: utf-8 -- """HTML Injection in GitHub repository froxlor/froxlor prior to 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Gradio - Open Redirect Detection

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

Liferay Portal & DXP - Cross-Site Scripting Detection

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay Portal 7."""...

ITFlow Unfinished Installation Detection

Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configure the database and create an admin account. !/usr/bin/env python3 -- coding: utf-8 -- """Detected ITFlow setup wizard was exposed with an unfinished installation, allowing attackers to configur...

Joomla! Installer Exposure Detection

Joomla is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Joomla is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Laravel File Manager - Panel Detect

Laravel File Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel File Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Laravel File Manager - Panel Detect',...

OpenVPN Server Router Management Panel - Detect

OpenVPN Server Router Management Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenVPN Server Router Management Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenVPN Server...

Ricoh Web Image Monitor - Reflected XSS Detection

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs multifunction printers which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. !/usr/bin/env python3 -- coding:...

Zimbra Collaboration Server 7.2.2/8.0.2 Local File Inclusion Detection

A directory traversal vulnerability in /res/I18nMsg,AjxMsg,ZMsg,ZmMsg,AjxKeys,ZmKeys,ZdMsg,Ajx%20TemplateMsg.js.zgz in Zimbra 7.2.2 and 8.0.2 allows remote attackers to read arbitrary files via a .. dot dot in the skin parameter. This can be leveraged to execute arbitrary code by obtaining LDAP...

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect Detection

The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. !/usr/bin/env...

Detect Selea Targa IP OCR-ANPR Camera

Various version of the Selea Targa IP OCR-ANPR Camera are vulnerable to an Unauthenticated RTP/RTSP/M-JPEG Stream Disclosure flaw !/usr/bin/env python3 -- coding: utf-8 -- """Various version of the Selea Targa IP OCR-ANPR Camera are vulnerable to an Unauthenticated RTP/RTSP/M-JPEG Str.""" from...

STUN Service Detection

Detects STUN RFC 5389 servers with a Binding Request on UDP 3478. !/usr/bin/env python3 -- coding: utf-8 -- """Detect STUN servers via Binding Request.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.stun.detectors import probestun class...

ThinkPHP 5.0.24 - Information Disclosure Detection

ThinkPHP 5.0.24 is susceptible to information disclosure. This version was configured without the PATHINFO parameter. This can allow an attacker to access all system environment parameters from index.php, thereby possibly obtaining sensitive information, modifying data, and/or executing...

Avatier Password Management Panel Detection

An Avatier password management panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Avatier password management panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avatier Password...

Micro Focus Operations Bridge Manager <=2020.05 - Remote Code Execution Detection

Micro Focus Operations Bridge Manager in versions 2020.05 and below is vulnerable to remote code execution via UCMDB. The vulnerability allows remote attackers to execute arbitrary code on affected installations of Data Center Automation. An attack requires network access and authentication as a...

Oracle Containers for J2EE 10g Panel - Detect

Oracle Containers for J2EE 10g panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Containers for J2EE 10g panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Containers for...

Polynote Panel - Detect

Polynote is a polyglot notebook supporting Scala, Python, SQL, and Spark with a rich UI !/usr/bin/env python3 -- coding: utf-8 -- """Polynote is a polyglot notebook supporting Scala, Python, SQL, and Spark with a rich UI.""" from kittysploit import from lib.protocols.http.httpclient import...

Microsoft FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a...

AVTECH Room Alert Login Panel - Detect

AVTECH Room Alert login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH Room Alert login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AVTECH Room Alert Login Panel -...

Telesquare TLR-2005KSH - Remote Command Execution Detection

Telesquare Tlr-2005Ksh is a Sk Telecom Lte router from South Korea's Telesquare company.Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 have an unauthorized remote command execution vulnerability. An attacker can exploit this vulnerability to execute system commands without authorization through...

NVIDIA Triton Inference Server <= 26.02 - Authentication Bypass Detection

NVIDIA Triton Inference Server contains an authentication bypass vulnerability, letting attackers bypass authentication and potentially execute code, escalate privileges, tamper data, cause denial of service, or disclose information, exploit requires no special conditions. !/usr/bin/env python3 -...

YesWiki < 4.5.4 - Cross-Site Scripting Detection

YesWiki 4.5.4 contains a reflected cross-site scripting caused by unsanitized idformulaire parameter in /?BazaR endpoint, letting attackers steal cookies and hijack sessions, exploit requires user to click malicious link. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki 4.""" from kittysploit...

HyperComments <= 1.2.2 - Arbitrary Options Update Detection

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

WordPress Welcart e-Commerce <2.8.5 - Arbitrary File Access Detection

WordPress Welcart e-Commerce plugin before 2.8.5 is susceptible to arbitrary file access. The plugin does not validate user input before using it to output the content of a file, which can allow an attacker to read arbitrary files on the server, obtain sensitive information, modify data, and/or...

Interact Software Panel - Detect

Interact Software was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Interact Software was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Interact Software Panel - Detect', 'description': 'Interact...

Dnsmasq Config - File Disclosure Detection

Dnsmasq Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Dnsmasq Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dnsmasq Config - File Disclosure Detection', 'description':...

Nitro Pro PDF Reader 11 Javascript API RCE

CVE-2017-7442: Nitro / Nitro Pro PDF Reader 11 unsafe Javascript API. this.saveAs writes an embedded HTA to disk; app.launchURL with a c$: path bypasses the security dialog and executes it. Cmd/PowerShell payloads are run from the HTA directly. Binary MZ payloads are staged over HTTP as a...

S7 PLC password bruteforce

Attempts common Siemens S7 session passwords against protected PLCs. Use only on authorized lab systems — rate-limited by default. !/usr/bin/env python3 -- coding: utf-8 -- import os from kittysploit import from lib.protocols.ics.constants import ICSPROTOCOLPORTS from...

MinIO Public Bucket Listing Verification

Confirms anonymous ListBuckets or open bucket listing on MinIO/S3 API. !/usr/bin/env python3 -- coding: utf-8 -- """Verify MinIO/S3 anonymous bucket listing.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.responsevalidation import isxmlrespon...

GCP Compute SSH Pivot via Metadata

Pivot to a VM by injecting an SSH key into Compute metadata and preparing a Compute SSH session !/usr/bin/env python3 -- coding: utf-8 -- import json import time from kittysploit import from lib.post.gcp import GcpPostMixin class ModulePost, GcpPostMixin: info = "name": "GCP Compute SSH Pivot via...

Azure Blob public listing detect

Checks if Azure Blob container listing is anonymously accessible no exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Détection listing public Azure Blob container check-only.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

DVWA SQLi shell (lab)

Login to DVWA CSRF token, set security low, UNION SQLi on /vulnerabilities/sqli/; uses lib Sqli pseudo-shell shellsqli or singlesql. !/usr/bin/env python3 -- coding: utf-8 -- """ DVWA SQL Injection lab helper authorized testing only. Authenticates like other DVWA KittySploit modules, forces...

Langflow CSV Agent RCE detection

Detects Langflow instances affected by CVE-2026-27966 by checking version 1.8.0 and optionally validating API key access. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Langflo...

Simple Login Scanner

Simple scanner that detects login forms on a web page !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient import re class ModuleAuxiliary, Httpclient: info = 'name': 'Simple Login Scanner', 'description': 'Simple scanner that...

MySQL Database Connection

Connect to MySQL database and execute SQL queries from kittysploit import class ModulePost: info = "name": "MySQL Database Connection", "description": "Connect to MySQL database and execute SQL queries", "author": "KittySploit Team", "sessiontype": SessionType.PHP, "arch": Arch.PHP, 'agent':...

SSRF Scanner

Scans for Server-Side Request Forgery SSRF vulnerabilities including internal network access, cloud metadata endpoints, and protocol handlers !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.moduleresult...