ETIC Telecom Device Login - Panel Detection

ETIC Telecom device login panel was discovered !/usr/bin/env python3 -- coding: utf-8 -- """ETIC Telecom device login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ETIC Telecom Device Login -...

Payment Gateway for Telcell < 2.0.4 - Open Redirect Detection

The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Open Redirect issue !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not validate the apiurl parameter before redirecting the user to its value, leading to an Ope.""" import re fr...

Gurock TestRail Application files.md5 Exposure Detection

Improper access control in Gurock TestRail versions 7.2.0.3014 resulted in sensitive information exposure. A threat actor can access the /files.md5 file on the client side of a Gurock TestRail application, disclosing a full list of application files and the corresponding file paths which can then...

ClearPass Policy Manager Login Panel - Detect

ClearPass Policy Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ClearPass Policy Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ClearPass Policy...

Meteor.js Framework - Detect

Detects the presence of Meteor.js, an open-source isomorphic JavaScript web framework written using Node.js. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Meteor.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

OpenEMR < 7.0.1 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.""" from kittysploit import from lib.protocols.http.httpclient import...

SSH Authorized Keys File - Detect

SSH authorized keys file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SSH authorized keys file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SSH Authorized Keys File - Detect',...

SysAid Login Panel - Detect

Detects the presence of a SysAid Help Desk Software login panel by identifying characteristic login pages, favicon hash, and system-specific content. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of a SysAid Help Desk Software login panel by identifying characteristic login...

ESAFENET CDG - Arbitrary File Download Detection

ESAFENET CDG V3 and V5 has an arbitrary file download vulnerability via the fileName parameter in download.jsp because the InstallationPack parameter is mishandled in a /CDGServer3/ClientAjax request. !/usr/bin/env python3 -- coding: utf-8 -- """ESAFENET CDG V3 and V5 has an arbitrary file downlo...

WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting Detection

WordPress Supsystic Ultimate Maps plugin before 1.2.5 contains an unauthenticated reflected cross-site scripting vulnerability due to improper sanitization of the tab parameter on the options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsyst...

Detect Springboot Thread Dump page

The threaddump endpoint provides a thread dump from the application's JVM. !/usr/bin/env python3 -- coding: utf-8 -- """The threaddump endpoint provides a thread dump from the application's JVM.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Unitronics PLC - Login Panel Detection

Unitronics PLC web interface panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Unitronics PLC web interface panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unitronics PLC ...

Ruby Configuration File - Detect

Multiple Ruby configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Ruby configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ruby Configuration File -...

Wallix Access Manager Panel - Detect

Wallix Access Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wallix Access Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info =...

Agent-Zero Application - Detect

Detected Agent-Zero AI agent framework installation. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Agent-Zero AI agent framework installation.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Agent-Zero...

NocoBase - Detect

NocoBase is an open source, extensibility-first, low-code platform for building business applications and enterprise solutions. !/usr/bin/env python3 -- coding: utf-8 -- """NocoBase is an open source, extensibility-first, low-code platform for building business applications and ente.""" from...

CAS Login Panel - Detect

CAS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CAS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CAS Login Panel - Detect', 'description': 'CAS login panel was...

HP Virtual Connect Manager Login Panel - Detect

HP Virtual Connect Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HP Virtual Connect Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP Virtual Connec...

MetInfo 7.0.0 beta - SQL Injection Detection

MetInfo 7.0.0 beta is susceptible to SQL injection via the admin/?n=language&c=languagegeneral&a=doSearchParameter appno parameter a different issue than CVE-2019-16997. !/usr/bin/env python3 -- coding: utf-8 -- """MetInfo 7.""" from kittysploit import from lib.protocols.http.httpclient import...

Unleash Panel - Detect

Open-source feature management solution built for developers. !/usr/bin/env python3 -- coding: utf-8 -- """Open-source feature management solution built for developers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Jira Netic Group Export <1.0.3 - Missing Authorization Detection

Jira Netic Group Export add-on before 1.0.3 contains a missing authorization vulnerability. The add-on does not perform authorization checks, which can allow an unauthenticated user to export all groups from the Jira instance by making a groupexportdownload=true request to a...

Zabbix Installation Exposure Detection

Zabbix is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Microsoft FTP Service - Detect

The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol that transfers computer files between a...

OpenNMS Dashboard - Exposure Detection

OpenNMS Dashboard exposure was detected. OpenNMS is an enterprise-grade network monitoring platform. Exposed dashboards may reveal sensitive network infrastructure information, monitoring data, alarms, and potentially allow unauthorized access. !/usr/bin/env python3 -- coding: utf-8 -- """OpenNMS...

SourceBans <2.0 - Cross-Site Scripting Detection

SourceBans before 2.0 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via the advSearch parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """SourceBans before 2.""" from kittysploit import from...

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting Detection

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter. !/usr/bin/env python3 --...

Argus Surveillance DVR 4.0.0.0 - Local File Inclusion Detection

Argus Surveillance DVR 4.0.0.0 devices allow unauthenticated local file inclusion, leading to file disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Argus Surveillance DVR 4.""" from kittysploit import from lib.protocols.http.httpclien...

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery Detection

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication. !/usr/bin/env python3 -- coding...

ZenML ZenML Server - Improper Authentication Detection

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. !/usr/bin/env python3 --...

WordPress Highlight and Share CVE-2025-67586

Detects vulnerable Highlight and Share plugin versions = 5.2.0 exposed to unauthenticated email share abuse via admin-ajax. !/usr/bin/env python3 -- coding: utf-8 -- from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress cla...

Kibana detection

Detects if Kibana is installed on the target. !/usr/bin/env python3 -- coding: utf-8 -- """Détection Kibana.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Kibana detection", "description": "Detects if Kibana is...

Android Get Info

Get information about an Android device from kittysploit import class ModulePost: info = 'name': 'Android Get Info', 'description': 'Get information about an Android device', 'author': 'KittySploit Team', 'sessiontype': SessionType.ANDROID, 'agent': 'risk': 'intrusive', 'effects':...

Wordpress Plugin ACF Frontend Display

Wordpress Plugin ACF Frontend Display = 2.0.6 - Arbitrary File UploadThe ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. from kittysploit import from...

Check robots.txt

Crawl a web site and store information about what was found from kittysploit import from lib.protocols.http.httpclient import Httpclient from colorama import Fore, Style class ModuleAuxiliary, Httpclient: info = 'name': 'Check robots.txt', 'description': 'Crawl a web site and store information...

Wordpress Plugin Ad Inserter rce

The ad-inserter plugin before 2.4.22 for WordPress has remote code execution. from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.protocols.http.wordpress import Wordpress class ModuleExploit, Httpclient, Wordpress: info = "name": "Wordpress Plugin Ad Inserter...

Zerologon DC Password Reset (CVE-2020-1472)

Exploits CVE-2020-1472 Zerologon: brute-forces NetrServerAuthenticate3 with all-zero credentials, then resets the domain controller machine account password to empty via NetrServerPasswordSet2. Enables DCSync with secretsdump using -hashes...

FUEL CMS PHP Code Evaluation RCE (CVE-2018-16763)

Exploits CVE-2018-16763 in FUEL CMS 1.4.1 via PHP code evaluation in the /fuel/pages/select/ filter parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS filter parameter PHP RCE CVE-2018-16763.""" import re import urllib.parse from kittysploit import from lib.protocols.http.httpclient...

Cisco Secure Email Gateway SQLi Chain (CVE-2026-76461)

Targets CVE-2026-76461 pre-authentication SQL injection in Cisco Secure Email Gateway AsyncOS email parsing. Confirms vulnerable AsyncOS builds via the management portal and documents SMTP-side exploitation TCP/25. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Secure Email Gateway AsyncOS SQ...

NVIDIA Triton Inference Server Auth Bypass (CVE-2026-24207)

Exploits CVE-2026-24207 in NVIDIA Triton Inference Server = 26.02: unauthenticated access to restricted HTTP APIs including /models and model management endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """NVIDIA Triton Inference Server auth bypass CVE-2026-24207.""" import json from kittysplo...

SonicWall SMA1000 CVE-2026-83548 SSRF Detect

Detects CVE-2026-83548 in SonicWall SMA1000 WorkPlace before hotfixes 12.4.3-03526 / 12.5.0-02952. Sends an unauthenticated absolute-form OPTIONS request that WorkPlace forwards to loopback CouchDB; a 405 methodnotallowed JSON body confirms the SSRF primitive. !/usr/bin/env python3 -- coding: utf...

WSO2 JWT Auth Bypass Admin Enum (CVE-2026-5430)

Uses CVE-2026-5430 to reach WSO2 admin APIs with a forged alg:none JWT in X-JWT-Assertion. Lists applications and subscription keys when the gateway fails open on unsupported JWT algorithms. !/usr/bin/env python3 -- coding: utf-8 -- """WSO2 CVE-2026-5430 JWT alg:none admin API access via...

Check Point CVE-2026-85102 VPN Detect

Detects Check Point Security Gateway / Spark firewall exposure to CVE-2026-85102: improper certificate validation during Site-to-Site or Remote Access VPN negotiation sk1000117. Fingerprints SSL VPN / Mobile Access login surfaces and flags builds before fixed JHF takes. !/usr/bin/env python3 --...

Netcore NAP930 CVE-2026-102240 Detect

Detects CVE-2026-102240 in Netcore NAP930 access points: pre-auth command injection in /cgi-bin/networktools via eval on raw QUERYSTRING before the sid session check. Confirms endpoint presence and optionally writes a marker file to /www/ when activeprobe is enabled. !/usr/bin/env python3 --...

Zabbix locales.php RCE

Exploits unauthenticated PHP code injection in Zabbix = 1.6.2 via the extlang parameter on locales.php. Opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix locales.php RCE = 1.6.2 — execute session.""" from future import annotations import re from urllib.pars...

Apache Solr Velocity Template RCE (CVE-2019-0193)

Exploits CVE-2019-0193 Velocity template injection on /core/select when the VelocityResponseWriter is enabled. Runs OS commands via wt=velocity and opens an interactive execute session. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr Velocity template RCE CVE-2019-0193 — execute...

D-Link DIR - __show_info.php File Read (CVE-2017-12943)

Reads arbitrary files via REQUIREFILE on /model/showinfo.php CVE-2017-12943. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR showinfo.php file read CVE-2017-12943.""" from urllib.parse import quote from kittysploit import from lib.protocols.http.httpclient import Httpclient from...

Apache Solr CVE-2023-50386 Backup/Restore RCE Detection

Detects Apache Solr 6.0.0–8.11.2 / 9.0.0–9.4.0 in SolrCloud mode with reachable ConfigSets API CVE-2023-50386 attack surface. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr CVE-2023-50386 detection backup/restore ConfigSet RCE surface.""" import re from kittysploit import from...

Grav CMS Blueprint dynamicData RCE (CVE-2026-65008)

Exploits CVE-2026-65008 in Grav CMS 2.0.7 fixed in 2.0.7: an authenticated user with admin.pages permission can plant a malicious forms frontmatter directive data-opts@ that routes through Blueprint::dynamicData to Grav\Common\Utils::arrayFilterRecursive and system. Execution triggers when any...

vBulletin - decodeArguments RCE Detection (CVE-2015-7808)

Detects CVE-2015-7808 by sending a crafted serialized payload to /ajax/api/hook/decodeArguments that triggers phpinfo. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin 5.x pre-auth object injection RCE CVE-2015-7808.""" from urllib.parse import quote from kittysploit import from...

TerraMaster NAS - makecvs.php Info Disclosure (CVE-2019-18385)

Detects CVE-2019-18385 by requesting /include/makecvs.php?Event=http and looking for Client-PORT / Client-IP headers in the response. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster NAS makecvs.php Event=http info disclosure CVE-2019-18385.""" from kittysploit import from...