KevinLAB BEMS (Building Energy Management System) - Backdoor Account Detection

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...

MODx manager - Local File Inclusion Detection

A directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl and possibly earlier allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter when magicquotesgpc is disabled. !/usr/bin/env python3 -- coding: utf-8 -...

DevExpress - Detect

Detect DevExpress based on the existence of its HTTP handler for serving images, scripts, and other resources to the client side. !/usr/bin/env python3 -- coding: utf-8 -- """Detect DevExpress based on the existence of its HTTP handler for serving images, scripts, and other resources .""" from...

OpenEMR < 7.0.1 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.""" from kittysploit import from lib.protocols.http.httpclient import...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution Detection

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

Microweber < 1.2.11 - Open Redirection Detection

Open Redirect in Packagist microweber/microweber prior to 1.2.11. !/usr/bin/env python3 -- coding: utf-8 -- """Open Redirect in Packagist microweber/microweber prior to 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

D-Link Network Attached Storage - Backdoor Account Detection

A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user...

FetchFile Servlet - Path Traversal Detection (CVE-2016-6601)

Detects CVE-2016-6601 by reading /etc/passwd or conf/securitydbData.xml via /servlets/FetchFile?fileName=. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple vendors /servlets/FetchFile path traversal CVE-2016-6601.""" import re from kittysploit import from lib.protocols.http.httpclient import...

BlueCoat Telnet Proxy - Detect

Detects Blue Coat telnet proxy services. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Blue Coat telnet proxy services.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'BlueCoat...

WordPress Twenty Seventeen - Full Path Disclosure Detection

WordPress Twenty Seventeen theme files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Twenty Seventeen theme files are publicly accessible...

Vespa - Detect

Vespa, an open-source big-data serving engine used for low-latency search, recommendation, and vector/embedding retrieval, increasingly deployed as the retrieval backend in AI and RAG retrieval-augmented generation pipelines, was detected. Exposed config-server or container endpoints could have...

VMware vCenter Converter Panel - Detect

VMware vCenter Converter panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vCenter Converter panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware vCenter Converter Panel -...

Google Api Private Key Detection

Google API private keys are exposed in files. !/usr/bin/env python3 -- coding: utf-8 -- """Google API private keys are exposed in files.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Api Private Key...

WordPress Automatic Plugin <3.92.1 - Arbitrary File Download and SSRF Detection

WordPress Automatic plugin 3.92.1 is vulnerable to unauthenticated Arbitrary File Download and SSRF Located in the downloader.php file, could permit attackers to download any file from a site. Sensitive data, including login credentials and backup files, could fall into the wrong hands. This...

Magento Downloader - Full Path Disclosure Detection

Detected Magento Downloader component exposed internal file system paths through direct file access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Magento Downloader component exposed internal file system paths through direct file access.""" from kittysploit import from...

NocoBase - Detect

NocoBase is an open source, extensibility-first, low-code platform for building business applications and enterprise solutions. !/usr/bin/env python3 -- coding: utf-8 -- """NocoBase is an open source, extensibility-first, low-code platform for building business applications and ente.""" from...

NuGet Package.config File Disclosure Detection

Detects NuGet Package.config File Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects NuGet Package.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NuGet Package.config File Disclosure Detection',...

OKI Data Panel - Detect

OKI Data panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OKI Data panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OKI Data Panel - Detect', 'description': 'OKI Data panel was...

OpenShift OAuth Proxy - Panel Detect

Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login page content. Checks both the default port and port 9001. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login pa...

Oracle Database as a Service Detection

Detects Oracle Database as a Service. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle Database as a Service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Database as a Service Detection',...

Qualys Cloud Platform Login Panel - Detect

Qualys Cloud Platform login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualys Cloud Platform login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualys Cloud Platform Login...

WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion Detection

The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. !/usr/bin/env python3 --...

Default Parallels Plesk Panel Page Detection

Detects Default Parallels Plesk Panel Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Default Parallels Plesk Panel Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Default Parallels Plesk Panel Page...

FreePBX Admin Panel - Detect

FreePBX admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FreePBX admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FreePBX Admin Panel - Detect', 'description': 'FreePBX...

Apache Druid - Remote Code Execution Detection

Apache Druid is susceptible to remote code execution because by default it lacks authorization and authentication. Attackers can send specially crafted requests to execute arbitrary code with the privileges of processes on the Druid server. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Drui...

Springboot Env Actuator - Detect

Sensitive environment variables may not be masked !/usr/bin/env python3 -- coding: utf-8 -- """Sensitive environment variables may not be masked.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import validatespringjsonprobe from...

Azure - APIM Secret Key Detection

Azure APIM Secret Key !/usr/bin/env python3 -- coding: utf-8 -- """Azure APIM Secret Key.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Azure - APIM Secret Key Detection', 'description': 'Azure APIM Secret Key',...

Jenkins - Remote Command Injection Detection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...

SharePoint Webshell - ToolShell Detection

Detects a persistent webshell named 'spinstall0.aspx' deployed on Microsoft SharePoint servers. This file exposes sensitive cryptographic machineKey values from the SharePoint configuration, indicating the presence of a ToolShell backdoor implant. This implant is linked to targeted post-auth RCE...

Payment Gateway for Telcell < 2.0.4 - Open Redirect Detection

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Ope.""" import re fr...

WordPress Duplicator <1.4.7 - Authentication Bypass Detection

WordPress Duplicator plugin before 1.4.7 is susceptible to authentication bypass. The plugin discloses the URL of the backup to unauthenticated visitors accessing the main installer endpoint. If the installer script has been run once by an administrator, this allows download of the full site back...

Thinkphp Lang - Local File Inclusion Detection

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...

Netmaker - Hardcoded DNS Secret Key Detection

Netmaker makes networks with WireGuard. Prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage has been found in Netmaker allowing unauth users to interact with DNS API endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Netmaker makes networks with WireGuard.""" from kittysploit import...

PHPJabbers Food Delivery Script - SQL Injection Detection

PHPJabbers Food Delivery Script 3.0 has a SQL injection SQLi vulnerability in the "q" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Ruijie RG-EW1200G Router Background - Login Bypass Detection

A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to t...

Quttera Web Malware Scanner <= 3.4.1.48 - Sensitive Data Exposure Detection

The Quttera Web Malware Scanner WordPress plugin before 3.4.2.1 doesn't restrict access to detailed scan logs, which allows a malicious actor to discover local paths and portions of the site's code !/usr/bin/env python3 -- coding: utf-8 -- """The Quttera Web Malware Scanner WordPress plugin befor...

Chartify – WordPress Chart Plugin < 2.9.6 - Local File Inclusion Detection

The Chartify – WordPress Chart Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.5 via the 'source' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the executio...

Node.js st module Directory Traversal Detection

A directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary files via a %2e%2e encoded dot dot in an unspecified path. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the st module before 0.""" import ...

Spring Security OAuth2 Remote Command Execution Detection

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Mitel MiCollab AWV 8.1.2.4 and 9.1.3 - Directory Traversal Detection

A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the server via a crafted URL, due to insufficient access validation. A successful exploit...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting Detection

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. !/usr/bin/env python3 -- coding: utf-8 -- """Agentejo...

Clansphere CMS 2011.4 - Cross-Site Scripting Detection

Clansphere CMS 2011.4 contains an unauthenticated reflected cross-site scripting vulnerability via the "language" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Clansphere CMS 2011.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

FUDForum 3.1.0 - Cross-Site Scripting Detection

FUDForum 3.1.0 contains a cross-site scripting vulnerability which allows remote attackers to inject JavaScript via index.php in the "srch" parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUDForum 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the integrated web server on Siemens SIMATIC S7-1200 CPU devices 2.x and 3.x allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the...

TOTOLINK A3002RU 1.0.8 - Information Disclosure Detection

TOTOLINK A3002RU firmware version 1.0.8 contains a vulnerability in which an unauthenticated attacker can obtain the plaintext admin password by making a GET request for password.htm. This allows remote attackers to gain administrative access without credentials. !/usr/bin/env python3 -- coding:...

elFinder <=2.1.60 - Local File Inclusion Detection

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. !/usr/bin/env python3 -- coding: utf-...

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting Detection

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter. !/usr/bin/env python3 --...

Magento Server MAGMI - Directory Traversal Detection

Magento Server MAGMI aka Magento Mass Importer contains a directory traversal vulnerability in web/ajaxpluginconf.php. that allows remote attackers to read arbitrary files via a .. dot dot in the file parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Magento Server MAGMI aka Magento Mass...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

ForgeRock OpenAM <7.0 - Remote Code Execution Detection

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...