Cortex XSOAR Login Panel - Detect

Cortex XSOAR login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cortex XSOAR login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cortex XSOAR Login Panel - Detect',...

JBoss detected

Detects JBoss detected. !/usr/bin/env python3 -- coding: utf-8 -- """Detects JBoss detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JBoss detected', 'description': 'Detects JBoss detected.',...

Dockge Panel - Detect

A fancy, easy-to-use and reactive self-hosted docker compose.yaml stack-oriented manager !/usr/bin/env python3 -- coding: utf-8 -- """A fancy, easy-to-use and reactive self-hosted docker compose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Netmask NPM Package - Server-Side Request Forgery Detection

Netmask NPM Package is susceptible to server-side request forgery because of improper input validation of octal strings in netmask npm package. This allows unauthenticated remote attackers to perform indeterminate SSRF, remote file inclusion, and local file inclusion attacks on many of the...

NUUO Network Video Recorder Login Panel - Detect

NUUO Network Video Recorder login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO Network Video Recorder login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NUUO Network...

WordPress Plugin Safe SVG - Full Path Disclosure Detection

WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Sekolahku CMS - Detect

Sekolahku CMS is a free, open-source, and easy-to-use content management system CMS for schools and educational institutions. It is designed to help schools manage their websites, manage student information, and manage school activities. !/usr/bin/env python3 -- coding: utf-8 -- """Sekolahku CMS ...

ESPEasy Mega Panel Exposure Detection

ESPEasy Mega Panel is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """ESPEasy Mega Panel is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ESPEasy Mega Panel Exposure Detection', 'description': 'ESPEa...

Blazor WebAssembly - Detect

Blazor WebAssembly application was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Blazor WebAssembly application was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Blazor WebAssembly - Detect',...

WordPress Simple Social Icons - Full Path Disclosure Detection

WordPress Plugin Simple Social Icons files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Simple Social Icons files are publicly...

Prodigy Annotation Tool - Unauthenticated Exposure Detection

Prodigy, a commercial scriptable annotation tool by Explosion AI used to label training data for machine learning and NLP models, was detected. Its local web server default port 8080, built on uvicorn/FastAPI ships with no built-in authentication or user accounts by default and is designed to run...

Rise Up Login Panel - Detect

Rise Up login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Rise Up login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Rise Up Login Panel - Detect', 'description': 'Rise Up...

HiveQueue Agent Detection

HiveQueue Agent is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """HiveQueue Agent is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HiveQueue Agent Detection', 'description': 'HiveQueue Agent is...

VMware FTP Server Login Panel - Detect

VMware FTP Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware FTP Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware FTP Server Login Panel -...

Oracle Integrated Lights Out Manager Login Panel - Detect

Oracle Integrated Lights Out Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Integrated Lights Out Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Pyramid Debug Toolbar Detection

Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application. !/usr/bin/env python3 -- coding: utf-8 -- """Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application.""" from kittysploit import from...

EVlink City < R8 V3.4.0.1 - Authentication Bypass Detection

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability Detection

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

EPrints 3.4.2 - Cross-Site Scripting Detection

EPrints 3.4.2 contains a reflected cross-site scripting vulnerability in the dataset parameter to the cgi/dataset dictionary URI. !/usr/bin/env python3 -- coding: utf-8 -- """EPrints 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

ConnectWise Control Remote Support Software Panel - Detect

Detects ConnectWise Control Remote Support Software Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ConnectWise Control Remote Support Software Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...

Stirling PDF Panel - Detect

Stirling PDF panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Stirling PDF panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Stirling PDF Panel - Detect', 'description': 'Stirlin...

YzmCMS v3.6 - Cross-Site Scripting Detection

In YzmCMS 3.6, index.php has XSS via the a, c, or m parameter. !/usr/bin/env python3 -- coding: utf-8 -- """In YzmCMS 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YzmCMS v3.6 - Cross-Site Scripting Detection',...

Clave Login Panel - Detect

Clave login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Clave login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Clave Login Panel - Detect', 'description': 'Clave login...

Ivanti(R) Cloud Services Appliance - Panel Detection

An Ivanti Cloud Services Appliance panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Ivanti Cloud Services Appliance panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IvantiR Cloud...

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting Detection

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on.""" from...

FileGator Panel - Detect

Detects FileGator Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FileGator Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FileGator Panel - Detect', 'description': 'Detects...

Trilium Notes Installer - Exposure Detection

Detects if the Trilium Notes setup page is accessible. !/usr/bin/env python3 -- coding: utf-8 -- """Detects if the Trilium Notes setup page is accessible.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Trilium Notes...

Wagtail Login - Detect

The Wagtail panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """The Wagtail panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wagtail Login - Detect', 'description': 'The...

Manage Cabinet Register - Exposed Detection

The path to the Cabinet Storage is omniapp/pages/cabinet/managecabinet.jsf?Action=1. If exposed, it gives an attacker insight into information such as Storage Volume Name, Cabinet Name, it's alias, Deployed AppServer IP Address and Port !/usr/bin/env python3 -- coding: utf-8 -- """The path to the...

Jolokia - CompilerDirectivesAdd File Read Detection

Jolokia is vulnerable to local file inclusion via compilerDirectivesAdd. !/usr/bin/env python3 -- coding: utf-8 -- """Jolokia is vulnerable to local file inclusion via compilerDirectivesAdd.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Adobe AEM CRX Namespace Editor Exposure Detection

Adobe AEM CRX Namespace Editor is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM CRX Namespace Editor is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Namespace Editor Exposu...

TIBCO Managed File Transfer - Panel Detection

TIBCO Managed File Transfer Login Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """TIBCO Managed File Transfer Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TIBCO Manag...

Multi-function Printer - Unauthorized Access Detection

Unauthorized access to MFP Multi-function printer using eSCL protocol allows attackers to scan documents left physically in the printer and send them to an arbitrary location. Furthermore, exposure of this endpoint allows attackers to gather information about the printer, serial number, model, an...

Laravel File Manager - Panel Detect

Laravel File Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel File Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Laravel File Manager - Panel Detect',...

Versa Networks Detection

Detects Versa Networks Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Versa Networks Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info = 'name': 'Versa...

Discuz Panel - Detection

Detects Discuz Panel - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Discuz Panel - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Discuz Panel - Detection', 'description': 'Detects Disc...

WordPress Simple Job Board - Unauthorized Data Access Detection

The Simple Job Board plugin for WordPress is vulnerable to unauthorized data access due to insufficient authorization checking in the fetchquickjob function in all versions up to and including 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be...

Drupal avatar_uploader v7.x-1.0-beta8 - Local File Inclusion Detection

In avataruploader v7.x-1.0-beta8 the view.php program doesn't restrict file paths, allowing unauthenticated users to retrieve arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """In avataruploader v7.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclie...

CKAN DataStore SQL Search - SQL Injection Detection

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN, an open-source data management system used for powering open data...

XWiki >= 6.0-rc-1 - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the delete template to perform a XSS, e.g. by using URL such as:...

Docassemble - Local File Inclusion Detection

Docassemble is an expert system for guided interviews and document assembly. The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96. The vulnerability has been patched in version 1.4.97 of the mast...

phpVMS < 7.0.6 - Legacy Importer Authorization Bypass Detection

phpVMS 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """phpVMS 7.""" from kittysploit import...

Honeypot Detection

Honeypot was Detected. !/usr/bin/env python3 -- coding: utf-8 -- """Honeypot was Detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Honeypot Detection', 'description': 'Honeypot was Detected.',...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass Detection

Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable to a directory traversal vulnerability when processing a sessionid cookie, which allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS. !/usr/bin/env...

Mitel NuPoint Unified Messaging Panel - Detect

Mitel NuPoint Unified Messaging login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Mitel NuPoint Unified Messaging login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mitel...

LUA Runtime Error - Page Detection

Detects LUA Runtime Error - Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects LUA Runtime Error - Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LUA Runtime Error - Page Detection', 'description':...

Google for WooCommerce <= 2.8.6 - Information Disclosure via Publicly Accessible PHP Info File Detection

The Google for WooCommerce plugin for WordPress is vulnerable to Information Disclosure in all versions up to, and including, 2.8.6. This is due to publicly accessible printphpinformation.php file. This makes it possible for unauthenticated attackers to retrieve information about Webserver and PH...

Spring Cloud Config - Local File Inclusion Detection

Spring Cloud Config versions 2.2.x prior to 2.2.2, 2.1.x prior to 2.1.7, and older unsupported versions are vulnerable to local file inclusion because they allow applications to serve arbitrary configuration files through the spring-cloud-config-server module. !/usr/bin/env python3 -- coding: utf...

vsFTPd Service - Detect

vsFTPd FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """vsFTPd FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'vsFTPd Service - Detect',...