JFrog Login Panel - Detect

JFrog login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JFrog Login Panel - Detect', 'description': 'JFrog login...

Froxlor < 0.10.38.2. - HTML Injection Detection

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. !/usr/bin/env python3 -- coding: utf-8 -- """HTML Injection in GitHub repository froxlor/froxlor prior to 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

IBM BigFix Platform - Information Disclosure Detection

IBM BigFix Platform 9.2 and 9.5 contains an information disclosure vulnerability caused by not enabling authenticated access in relay, letting remote attackers query and gather update and fixlet information, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """IBM BigF...

Joomla! Component SMEStorage - Local File Inclusion Detection

A directory traversal vulnerability in the SMEStorage comsmestorage component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal...

WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting Detection

WordPress enhanced-tooltipglossary 3.2.8 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Oracle GlassFish Server Open Source Edition 4.1 - Local File Inclusion Detection

Oracle GlassFish Server Open Source Edition 4.1 is vulnerable to both authenticated and unauthenticated local file inclusion vulnerabilities that can be exploited by issuing specially crafted HTTP GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle GlassFish Server Open Source Editi...

Angular JSON File Exposure Detection

Detects Angular JSON File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Angular JSON File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Angular JSON File Exposure Detection', 'description...

Jolokia Configuration - Exposure Detection

Detected exposed Jolokia configuration files jolokia-agent.properties and jolokia-access.xml. Exposure of these files could have revealed sensitive agent configuration, authentication credentials, or access control policies CORS, allowed MBeans. !/usr/bin/env python3 -- coding: utf-8 -- """Detect...

WordPress Plugin CodeArt Google MP3 Player - File Disclosure Download Detection

WordPress Plugin CodeArt Google MP3 Player allows an unauthenticated attacker to download file from server. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CodeArt Google MP3 Player allows an unauthenticated attacker to download file from server.""" from kittysploit import from...

WordPress Adaptive Images < 0.6.69 - Cross-Site Scripting Detection

WordPress Adaptive Images 0.6.69 is susceptible to cross-site scripting because the plugin does not sanitize and escape the REQUESTURI before outputting it back in a page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Adaptive Images 0.""" from kittysploit import from...

Sharp Multifunction Printers - Local File Inclusion Detection

It was observed that Sharp printers are vulnerable to a local file inclusion without authentication. Any attacker can read any file located in the printer. !/usr/bin/env python3 -- coding: utf-8 -- """It was observed that Sharp printers are vulnerable to a local file inclusion without...

WordPress WPQA <5.5 - Improper Access Control Detection

WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WPQA plugin before 5.""...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability...

WordPress Perfect Images (WP Retina 2x) < 6.4.6 - Sensitive Information Exposure Detection

Jordy Meow Perfect Images Manage Image Sizes, Thumbnails, Replace, Retina versions up to 6.4.5 contain a vulnerability that exposes sensitive information to unauthorized actors, letting attackers access confidential data, exploit requires no specific conditions. !/usr/bin/env python3 -- coding:...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download Detection

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

Dashy <= 4.3.6 - Reflected XSS via Workspace Detection

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

Helicone Panel - Detect

Helicone, an open-source LLM observability platform that provides logging, monitoring, and analytics for LLM applications and is commonly self-hosted via Docker, was detected. An exposed, unauthenticated Helicone web dashboard instance was identified. !/usr/bin/env python3 -- coding: utf-8 --...

SAS Login Panel - Detect

SAS login panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """SAS login panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAS Login Panel - Detect', 'description': 'SAS login...

HUE Personal Wireless Lighting Panel Detection

HUE personal wireless lighting panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HUE personal wireless lighting panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HUE Personal Wireless...

Hanta Internet Behavior Management System - Remote Code Execution Detection

Hanta Internet Behavior Management System is vulnerable to RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Hanta Internet Behavior Management System is vulnerable to RCE.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WordPress Installer Log Detection

This file is generated during the installation process of wordpress and is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """This file is generated during the installation process of wordpress and is exposed.""" import re from kittysploit import from lib.protocols.http.httpclient import...

GitLab public repositories Detection

Detects GitLab public repositories. !/usr/bin/env python3 -- coding: utf-8 -- """Detects GitLab public repositories.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GitLab public repositories Detection', 'description...

Triofox - Improper Access Control Detection

The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely...

myLittleAdmin Login Panel - Detect

myLittleAdmin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """myLittleAdmin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myLittleAdmin Login Panel - Detect',...

Tomcat Stack Traces Enabled Detection

Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern.""" from kittysploit import from...

Zebra Printer Detect

Zebra Printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zebra Printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zebra Printer Detect', 'description': 'Zebra Printer...

BlackMoon FTP Chaos Edition Service - Detect

BlackMoon FTP Chaos Edition service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BlackMoon FTP Chaos Edition service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info =...

NATS Messaging Server Detection

Detects NATS servers by reading the INFO greeting on TCP 4222. !/usr/bin/env python3 -- coding: utf-8 -- """Detect NATS messaging servers via INFO handshake.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from lib.scanner.nats.detectors import probenats...

Zhiyuan OA Arbitrary File Upload Vulnerability Detection

A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload arbitrary files to the remote server and cause execute arbitrary code to be executed. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload...

ProFTPD Server Detect

The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a client and server on a computer network. !/usr/bin/env python3 -- coding: utf-8 -- """The File Transfer Protocol FTP is a standard network protocol used to transfer computer files between a...

Spring Security OAuth2 Remote Command Execution Detection

Spring Security OAuth versions 2.0.0 to 2.0.9 and 1.0.0 to 1.0.5 contain a remote command execution vulnerability. When processing authorization requests using the whitelabel views, the responsetype parameter value was executed as Spring SpEL which enabled a malicious user to trigger remote comma...

Trend Micro Threat Discovery Appliance 2.6.1062r1 - Authentication Bypass Detection

Trend Micro Threat Discovery Appliance 2.6.1062r1 is vulnerable to a directory traversal vulnerability when processing a sessionid cookie, which allows a remote, unauthenticated attacker to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS. !/usr/bin/env...

Aptana Jaxer 1.0.3.4547 - Local File inclusion Detection

Aptana Jaxer 1.0.3.4547 is vulnerable to local file inclusion in the wikilite source code viewer. An attacker can read internal files on the server via a tools/sourceViewer/index.html?filename=../ URI. !/usr/bin/env python3 -- coding: utf-8 -- """Aptana Jaxer 1.""" import re from kittysploit impo...

ZimaOS <= v1.2.4 - Sensitive Information Disclosure Detection

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoints in ZimaOS, such as http:///v1/users/image?path=/var/lib/casaos/1/apporder.json and http:///v1/users/image?path=/var/lib/casaos/1/system.json,...

WP Popups - Information Disclosure Detection

WP Popups - WordPress Popup builder plugin for WordPress contains a full path disclosure caused by using mobiledetect without access restrictions, letting unauthenticated attackers retrieve server paths, exploit requires no specific conditions. !/usr/bin/env python3 -- coding: utf-8 -- """WP Popu...

DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...

SSL VPN Session Hijacking Detection

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. !/usr/bin/env python3 -- coding: utf-8 -- """An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to by.""" from...

WP Content Copy Protection & No Right Click - Open Redirect Detection

The WP Content Copy Protection & No Right Click plugin before version 15.3 contains an open-redirect vulnerability via the referrer parameter in no-js.php, allowing redirection of users to external sites. !/usr/bin/env python3 -- coding: utf-8 -- """The WP Content Copy Protection & No Right Click...

DD-WRT - Router Panel Detection

DD-WRT router management panel detected. !/usr/bin/env python3 -- coding: utf-8 -- """DD-WRT router management panel detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DD-WRT - Router Panel Detection',...

Django Config - Detect

Django configuration information was detected, which could reveal web application framework exceptions that could indicate exploitation attempts. !/usr/bin/env python3 -- coding: utf-8 -- """Django configuration information was detected, which could reveal web application framework exceptions tha...

D-Link NAS `sc_mgr.cgi` - Remote Code Execution Detection

The D-Link NAS interface scmgr.cgi contains a command execution vulnerability that allows attackers to execute arbitrary commands on the device, potentially leading to unauthorized access or control over the system. !/usr/bin/env python3 -- coding: utf-8 -- """The D-Link NAS interface scmgr."""...

EasyCVR video management - Users Information Exposure Detection

EasyCVR video management platform has leaked user information !/usr/bin/env python3 -- coding: utf-8 -- """EasyCVR video management platform has leaked user information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

GEMweb Plus 500 Login Panel - Detect

GEMweb Plus 500 login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GEMweb Plus 500 login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GEMweb Plus 500 Login Panel - Detect',...

GMail API - Detect

GMail API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GMail API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GMail API - Detect', 'description': 'GMail API was detected.', 'author':...

Graphql wpgraphql Detect

Detects Graphql wpgraphql Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql wpgraphql Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql wpgraphql Detect', 'description': 'Detects...

Echelon i.LON SmartServer - Login Panel Detection

Echelon now Adesto/Dialog Semiconductor i.LON SmartServer is a LonWorks/IP-852 building automation controller used in HVAC, lighting, and energy management systems. The embedded web interface is frequently exposed on standard and non-standard ports. !/usr/bin/env python3 -- coding: utf-8 --...

mysql.initial Config - Detect

mysql.initial configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """mysql.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'mysql.initial Config - Detect', 'description': 'mysql.initial...

Feiyuxing Information - Exposure Detection

Feiyuxing enterprise-level intelligent online behavior management system has authority bypass and information leakage vulnerabilities, which can obtain administrator rights and user passwords !/usr/bin/env python3 -- coding: utf-8 -- """Feiyuxing enterprise-level intelligent online behavior...

FOSSBilling Panel - Detect

FOSSBilling panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FOSSBilling Panel - Detect', 'description':...

FTP Credentials Exposure Detection

FTP credentials were detected. !/usr/bin/env python3 -- coding: utf-8 -- """FTP credentials were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FTP Credentials Exposure Detection', 'description': 'FTP...