CaupoShop - template LFI Detection (CVE-2011-4832)

Detects CVE-2011-4832 via index.php?action=template&template=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4832 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

CasaOS - Unauth Config/Debug Disclosure (CVE-2025-34171)

CasaOS = 0.4.15 exposes unauthenticated /v1/users/image?path=... under /var/lib/casaos/1/ and /v1/sys/debug host information CVE-2025-34171. !/usr/bin/env python3 -- coding: utf-8 -- """CasaOS unauthenticated config/debug disclosure CVE-2025-34171.""" from kittysploit import from...

mDNS Amplification Attack Vector Detection

Sends a unicast mDNS PTR query for services.dns-sd.udp.local and checks whether the response is more than twice the request size, indicating the service can be abused for UDP amplification / reflection. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mDNS UDP amplification response...

Spring Cloud Function - routing-expression Detection (CVE-2022-22963)

Probes Spring Cloud Function endpoints for acceptance of the spring.cloud.function.routing-expression header CVE-2022-22963. Uses a non-destructive SpEL expression; confirmation of RCE requires the companion exploit with a reverse payload. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Cloud...

Accellion FTA - getStatus Command Injection (CVE-2015-2857)

Exploits CVE-2015-2857 by injecting OS commands via oauthtoken on /tws/getStatus. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Accellion FTA getStatus oauthtoken RCE CVE-2015-2857 — opens execute session.""" import re from urllib.parse import quote from...

ASUS RT - AICloud smb Traversal Detection (CVE-2013-4937)

Detects CVE-2013-4937 by requesting /smb/tmp/etc/shadow and matching passwd-style entries. !/usr/bin/env python3 -- coding: utf-8 -- """ASUS RT AICloud smb path traversal CVE-2013-4937.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

NUUO NVRmini 2 - File Upload Detection (CVE-2018-11523)

Detects CVE-2018-11523 by uploading a PHP phpinfo payload to /upload.php and verifying execution. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 unauthenticated PHP upload CVE-2018-11523.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

QNAP QTS/QuTS - Uninitialized quick.cgi Detection (CVE-2023-47218)

Detects an uninitialized QNAP NAS exposing /cgi-bin/quick/quick.cgi CVE-2023-47218 command injection surface. Looks for HTTP 200 with firmwareinfo or a failure/801 response to a random func parameter. !/usr/bin/env python3 -- coding: utf-8 -- """QNAP QTS/QuTS hero uninitialized quick.cgi...

Magento - local.xml Config Disclosure Detection

Detects exposed Magento /app/etc/local.xml containing database username/password. !/usr/bin/env python3 -- coding: utf-8 -- """Magento app/etc/local.xml configuration disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Trilium Notes CVE-2026-45668 Safe Import RCE Detect

Detects CVE-2026-45668 in Trilium Notes TriliumNext desktop = 0.102.1: safe import fails to strip docName path traversal and code-note XSS, enabling RCE in the nodeIntegration Electron renderer. Fingerprints /bootstrap for triliumVersion fixed in 0.102.2. !/usr/bin/env python3 -- coding: utf-8 --...

JTL Shop CVE-2026-54390 Smarty SSTI Detect

Detects JTL Shop 5.2.0 through 5.7.1 vulnerable to CVE-2026-54390: contact form fields reach SmartyRenderer email subjects via fetch'string:' . $subject. Versions 5.4.0+ allow full RCE via registered Smarty modifiers; 5.2.x–5.3.x allow credential theft. !/usr/bin/env python3 -- coding: utf-8 --...

Lua / awk Reverse TCP

Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix from kittysploit import class ModulePayload: CLIENTLANGUAGE = "lua" info = "name": "Lua / awk Reverse TCP", "description": "Reverse TCP shell via Lua or awk minimal hosts / CTF / constrained Unix", "category":...

RDP Encryption Enumeration

Negotiates RDP security protocols and reports SSL / CredSSP NLA / RDSTLS selection NSE rdp-enum-encryption. !/usr/bin/env python3 -- coding: utf-8 -- """RDP encryption / NLA negotiation enum NSE rdp-enum-encryption.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

Windows x64 Reverse TCP Stager

Position-independent x64 reverse TCP shellcode that connects back and spawns cmd.exe from kittysploit import class ModulePayload: """Windows x64 reverse TCP stager cmd.exe. Compatible with listeners/multi/reversetcp.""" info = "name": "Windows x64 Reverse TCP Stager", "description":...

OpenVPN Access Server - Configuration Exposure Detection

Detected OpenVPN Access Server with sensitive configuration data exposed, including VPN client profiles, certificates, private keys, and session tokens, without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected OpenVPN Access Server with sensitive configuration data exposed,...

CmsEasy crossall_act - SQL Injection Detection

CmsEasy crossallact.php SQL Injection Vulnerability. CmsEasy has a SQL injection vulnerability. Any SQL command can be executed by encrypting the SQL statement in the file service.php. !/usr/bin/env python3 -- coding: utf-8 -- """CmsEasy crossallact.""" from kittysploit import from...

Cisco Smart Software Manager On-Prem Panel - Detect

Cisco Smart Software Manager On-Prem is an on-premises software license management solution offered by Cisco. It enables organizations to manage and optimize their Cisco software licenses, entitlements, and usage in their local data centers, providing greater control and visibility over software...

Wing FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a...

Nginx Dashboard Detection

Nginx Dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx Dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Dashboard Detection', 'description': 'Nginx Dashboard is...

Ricoh Web Image Monitor - Reflected XSS Detection

A reflected cross-site scripting vulnerability exists in the laser printers and MFPs multifunction printers which implement Ricoh Web Image Monitor. If exploited, an arbitrary script may be executed on the web browser of the user who accessed Web Image Monitor. !/usr/bin/env python3 -- coding:...

SAP Fiori Login Panel - Detect

SAP Fiori login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Fiori login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAP Fiori Login Panel - Detect', 'description': 'SA...

WordPress Download Manager <= 3.2.59 - Reflected XSS Detection

W3 Eden, Inc. Download Manager plugin = 3.2.59 contains a reflected cross-site scripting caused by insufficient input sanitization, letting attackers execute scripts in the context of the victim's browser, exploit requires attacker to craft a malicious link. !/usr/bin/env python3 -- coding: utf-8...

Joomla! Component com_biblestudy - Local File Inclusion Detection

A directory traversal vulnerability in the Bible Study combiblestudy component 6.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter in a studieslist action to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Roxy File Manager - Panel Detect

Roxy File Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Roxy File Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Roxy File Manager - Panel Detect', 'description...

Desktop Portal VMware Horizon DaaS Trade Platform Detection

Detects Desktop Portal VMware Horizon DaaS Trade Platform. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Desktop Portal VMware Horizon DaaS Trade Platform.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Deskt...

IBM Service Assistant Login Panel - Detect

IBM Service Assistant login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Service Assistant login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IBM Service Assistant Login...

FeiYuXing Enterprise Router - Information Leakage Detection

The FeiYuXing Enterprise Router Information Leakage Vulnerability is a critical flaw that allows unauthorized attackers to retrieve sensitive configuration details from the router. !/usr/bin/env python3 -- coding: utf-8 -- """The FeiYuXing Enterprise Router Information Leakage Vulnerability is a...

Appspace 6.2.4 - Server-Side Request Forgery Detection

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Appspace 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Appspace 6.2.4 - Server-Side...

LibreNMS Login Panel - Detect

LibreNMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """LibreNMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LibreNMS Login Panel - Detect', 'description':...

Sitecore Default Page - Detect

Detect Sitecore Content Management System CMS. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Sitecore Content Management System CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sitecore Default Page -...

WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion Detection

The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. !/usr/bin/env python3 --...

AEM QueryBuilder Feed Servlet Detection

Detects AEM QueryBuilder Feed Servlet. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AEM QueryBuilder Feed Servlet.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AEM QueryBuilder Feed Servlet Detection',...

Burp Collaborator Server - Detect

Burp Collaborator server detected. !/usr/bin/env python3 -- coding: utf-8 -- """Burp Collaborator server detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Burp Collaborator Server - Detect', 'description':...

Squid Analysis Report Generator Detection

SARG is an open source tool that allows you to analyse the squid log files and generates beautiful reports in HTML format with information about users, IP addresses, top accessed sites, total bandwidth usage, elapsed time, downloads, access denied websites, daily reports, weekly reports and month...

Jeecg-Boot Detect

Detects Jeecg-Boot Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jeecg-Boot Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jeecg-Boot Detect', 'description': 'Detects Jeecg-Boot Detect.',...

Python Flask-Security - Open Redirect Detection

Python Flask-Security contains an open redirect vulnerability. Existing code validates that the URL specified in the next parameter is either relative or has the same network location as the requesting URL. Certain browsers accept and fill in the blanks of possibly incomplete or malformed URLs. A...

MongoDB Ops Manager Login Panel - Detect

MongoDB Ops Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MongoDB Ops Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MongoDB Ops Manager Login Panel...

WordPress Checklist <1.1.9 - Cross-Site Scripting Detection

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Checklist plugin before 1.""" from kittysploit import from...

OpenVas Login Panel - Detect

An OpenVas Admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An OpenVas Admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenVas Login Panel - Detect',...

OpenShift OAuth Proxy - Panel Detect

Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login page content. Checks both the default port and port 9001. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login pa...

ILIAS eLearning <7.16 - Open Redirect Detection

ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """ILIAS eLearning before 7.""" import...

Nginx Status Page Detection

Detects Nginx Status Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx Status Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Status Page Detection', 'description': 'Detects Nginx Status...

Beszel Unfinished Installation Detection

Detected Beszel server monitoring hub had an unfinished installation with no admin account configured, allowing attackers to create an admin account and gain full control. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Beszel server monitoring hub had an unfinished installation with no adm...

UiPath Orchestrator Login Panel - Detect

UiPath Orchestrator login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """UiPath Orchestrator login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UiPath Orchestrator Login Panel...

PRONOTE Login Panel - Detect

PRONOTE products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PRONOTE products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PRONOTE Login Panel - Detect', 'description': 'PRONOTE produc...

POS Codekop v2.0 - Cross Site Scripting Detection

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php. !/usr/bin/env python3 -- coding: utf-8 -- """POS Codekop v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Nagios Login Panel - Detect

Nagios login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nagios login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nagios Login Panel - Detect', 'description': 'Nagios logi...

Peplink InControl - Login Panel Detection

Peplink InControl is a centralised cloud-based SD-WAN and device management platform for Peplink routers and access points, enabling remote configuration, monitoring, and SpeedFusion VPN management across distributed sites. !/usr/bin/env python3 -- coding: utf-8 -- """Peplink InControl is a...

MKdocs 1.2.2 - Directory Traversal Detection

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

Dgraph <= 25.3.2 - Admin Token Disclosure Detection

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...