Subrion CMS Web Installer - Exposure Detection

Subrion CMS Web Installer has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Subrion CMS Web Installer has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Subrion CMS Web Installer - Exposur...

MKdocs 1.2.2 - Directory Traversal Detection

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

WordPress 1 flash gallery listing Detection

Searches for sensitive directories present in the 1-flash-gallery plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the 1-flash-gallery plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Dgraph <= 25.3.2 - Admin Token Disclosure Detection

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

Cortex XSOAR Login Panel - Detect

Cortex XSOAR login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cortex XSOAR login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cortex XSOAR Login Panel - Detect',...

JBoss detected

Detects JBoss detected. !/usr/bin/env python3 -- coding: utf-8 -- """Detects JBoss detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JBoss detected', 'description': 'Detects JBoss detected.',...

Dockge Panel - Detect

A fancy, easy-to-use and reactive self-hosted docker compose.yaml stack-oriented manager !/usr/bin/env python3 -- coding: utf-8 -- """A fancy, easy-to-use and reactive self-hosted docker compose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

NUUO Network Video Recorder Login Panel - Detect

NUUO Network Video Recorder login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO Network Video Recorder login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NUUO Network...

WordPress Plugin Safe SVG - Full Path Disclosure Detection

WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

ActiveAdmin Admin Dasboard Exposure Detection

An ActiveAdmin Admin dashboard was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An ActiveAdmin Admin dashboard was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ActiveAdmin Admin Dasboard...

Sekolahku CMS - Detect

Sekolahku CMS is a free, open-source, and easy-to-use content management system CMS for schools and educational institutions. It is designed to help schools manage their websites, manage student information, and manage school activities. !/usr/bin/env python3 -- coding: utf-8 -- """Sekolahku CMS ...

ASP-Nuke - Open Redirect Detection

ASP-Nuke contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """ASP-Nuke contains an open redirect vulnerability."""...

Detect Springboot Beans Actuator

Displays a complete list of all the Spring beans in the application !/usr/bin/env python3 -- coding: utf-8 -- """Displays a complete list of all the Spring beans in the application.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

ESPEasy Mega Panel Exposure Detection

ESPEasy Mega Panel is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """ESPEasy Mega Panel is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ESPEasy Mega Panel Exposure Detection', 'description': 'ESPEa...

MAMP Server - Cross-Site Scripting Detection

A Cross-Site Scripting XSS vulnerability exists in the default installation of MAMP server. The file /Applications/MAMP/htdocs/index.php is susceptible to malicious input, allowing attackers to inject JavaScript code that executes in the context of the victim's browser. This vulnerability can be...

Blazor WebAssembly - Detect

Blazor WebAssembly application was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Blazor WebAssembly application was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Blazor WebAssembly - Detect',...

WordPress Simple Social Icons - Full Path Disclosure Detection

WordPress Plugin Simple Social Icons files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Simple Social Icons files are publicly...

Prodigy Annotation Tool - Unauthenticated Exposure Detection

Prodigy, a commercial scriptable annotation tool by Explosion AI used to label training data for machine learning and NLP models, was detected. Its local web server default port 8080, built on uvicorn/FastAPI ships with no built-in authentication or user accounts by default and is designed to run...

Rise Up Login Panel - Detect

Rise Up login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Rise Up login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Rise Up Login Panel - Detect', 'description': 'Rise Up...

Websheets Configuration File - Detect

Websheets configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Websheets configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Websheets Configuration File - Detect...

HiveQueue Agent Detection

HiveQueue Agent is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """HiveQueue Agent is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HiveQueue Agent Detection', 'description': 'HiveQueue Agent is...

VMware FTP Server Login Panel - Detect

VMware FTP Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware FTP Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware FTP Server Login Panel -...

Oracle Integrated Lights Out Manager Login Panel - Detect

Oracle Integrated Lights Out Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Integrated Lights Out Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Splunk MCP Server IDE Login - Detect

Splunk MCP Server IDE login interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk MCP Server IDE login interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Splunk MCP Serv...

CentreStack Login Panel - Detect

Gladinet CentreStack login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gladinet CentreStack login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CentreStack Login Panel -...

Pichome 2.1.0 - Arbitrary File Read Detection

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed t...

Easy FancyBox - Full Path Disclosure Detection

Easy FancyBox WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Easy FancyBox WordPress plug...

Dash Panel Detect

Detects Dash Panel Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dash Panel Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dash Panel Detect', 'description': 'Detects Dash Panel Detect.',...

Pyramid Debug Toolbar Detection

Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application. !/usr/bin/env python3 -- coding: utf-8 -- """Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application.""" from kittysploit import from...

EVlink City < R8 V3.4.0.1 - Authentication Bypass Detection

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability Detection

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

EPrints 3.4.2 - Cross-Site Scripting Detection

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. !/usr/bin/env python3 -- coding: utf-8 -- """EPrints 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

ConnectWise Control Remote Support Software Panel - Detect

Detects ConnectWise Control Remote Support Software Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ConnectWise Control Remote Support Software Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

PrismaWEB - Credentials Disclosure Detection

PrismaWEB is susceptible to credential disclosure. The vulnerability exists due to the disclosure of hard-coded credentials allowing an attacker to effectively bypass authentication of PrismaWEB with administrator privileges. The credentials can be disclosed by simply navigating to the loginpar.j...

DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...

Stirling PDF Panel - Detect

Stirling PDF panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Stirling PDF panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Stirling PDF Panel - Detect', 'description': 'Stirlin...

TOTOLINK A3700R - Command Injection Detection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in TOTOLINK A3700R v.""" import re from kittysploit import from...

YzmCMS v3.6 - Cross-Site Scripting Detection

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. !/usr/bin/env python3 -- coding: utf-8 -- """In YzmCMS 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YzmCMS v3.6 - Cross-Site Scripting Detection',...

HAProxy Statistics Page - Detect

HAProxy statistics page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HAProxy statistics page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HAProxy Statistics Page - Detect', 'description...

Clave Login Panel - Detect

Clave login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Clave login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Clave Login Panel - Detect', 'description': 'Clave login...

Ivanti(R) Cloud Services Appliance - Panel Detection

An Ivanti Cloud Services Appliance panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Ivanti Cloud Services Appliance panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IvantiR Cloud...

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting Detection

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on.""" from...

FileGator Panel - Detect

Detects FileGator Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FileGator Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FileGator Panel - Detect', 'description': 'Detects...

NocoDB < 0.258.0 - Reflected XSS in Password Reset Detection

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. !/usr/bin/env...

Trilium Notes Installer - Exposure Detection

Detects if the Trilium Notes setup page is accessible. !/usr/bin/env python3 -- coding: utf-8 -- """Detects if the Trilium Notes setup page is accessible.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Trilium Notes...

Wagtail Login - Detect

The Wagtail panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """The Wagtail panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wagtail Login - Detect', 'description': 'The...

OpenTouch Multimedia Services - Detect

OpenTouch Multimedia Services Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenTouch Multimedia Services Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenTouch...

Manage Cabinet Register - Exposed Detection

The path to the Cabinet Storage is omniapp/pages/cabinet/managecabinet.jsf?Action=1. If exposed, it gives an attacker insight into information such as Storage Volume Name, Cabinet Name, it's alias, Deployed AppServer IP Address and Port !/usr/bin/env python3 -- coding: utf-8 -- """The path to the...

Exposed Browserless debugger Detection

Browserless instance can be used to make web requests. May worth checking /workspace for juicy files. !/usr/bin/env python3 -- coding: utf-8 -- """Browserless instance can be used to make web requests.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Ecology OA CheckServer - SQL Injection Detection

Ecology OA system improperly filters incoming data from users, resulting in a SQL injection vulnerability. Remote and unauthenticated attackers can use this vulnerability to conduct SQL injection attacks and steal sensitive database information. !/usr/bin/env python3 -- coding: utf-8 -- """Ecolog...