SSL VPN Session Hijacking Detection

An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to bypass authentication. !/usr/bin/env python3 -- coding: utf-8 -- """An Improper Authentication vulnerability in the SSLVPN authentication mechanism allows a remote attacker to by.""" from...

WP Content Copy Protection & No Right Click - Open Redirect Detection

The WP Content Copy Protection & No Right Click plugin before version 15.3 contains an open-redirect vulnerability via the referrer parameter in no-js.php, allowing redirection of users to external sites. !/usr/bin/env python3 -- coding: utf-8 -- """The WP Content Copy Protection & No Right Click...

DD-WRT - Router Panel Detection

DD-WRT router management panel detected. !/usr/bin/env python3 -- coding: utf-8 -- """DD-WRT router management panel detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DD-WRT - Router Panel Detection',...

Django Config - Detect

Django configuration information was detected, which could reveal web application framework exceptions that could indicate exploitation attempts. !/usr/bin/env python3 -- coding: utf-8 -- """Django configuration information was detected, which could reveal web application framework exceptions tha...

D-Link NAS `sc_mgr.cgi` - Remote Code Execution Detection

The D-Link NAS interface scmgr.cgi contains a command execution vulnerability that allows attackers to execute arbitrary commands on the device, potentially leading to unauthorized access or control over the system. !/usr/bin/env python3 -- coding: utf-8 -- """The D-Link NAS interface scmgr."""...

EasyCVR video management - Users Information Exposure Detection

EasyCVR video management platform has leaked user information !/usr/bin/env python3 -- coding: utf-8 -- """EasyCVR video management platform has leaked user information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

GEMweb Plus 500 Login Panel - Detect

GEMweb Plus 500 login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GEMweb Plus 500 login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GEMweb Plus 500 Login Panel - Detect',...

GMail API - Detect

GMail API was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GMail API was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GMail API - Detect', 'description': 'GMail API was detected.', 'author':...

Graphql wpgraphql Detect

Detects Graphql wpgraphql Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql wpgraphql Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql wpgraphql Detect', 'description': 'Detects...

Echelon i.LON SmartServer - Login Panel Detection

Echelon now Adesto/Dialog Semiconductor i.LON SmartServer is a LonWorks/IP-852 building automation controller used in HVAC, lighting, and energy management systems. The embedded web interface is frequently exposed on standard and non-standard ports. !/usr/bin/env python3 -- coding: utf-8 --...

mysql.initial Config - Detect

mysql.initial configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """mysql.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'mysql.initial Config - Detect', 'description': 'mysql.initial...

Feiyuxing Information - Exposure Detection

Feiyuxing enterprise-level intelligent online behavior management system has authority bypass and information leakage vulnerabilities, which can obtain administrator rights and user passwords !/usr/bin/env python3 -- coding: utf-8 -- """Feiyuxing enterprise-level intelligent online behavior...

FOSSBilling Panel - Detect

FOSSBilling panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FOSSBilling Panel - Detect', 'description':...

FTP Credentials Exposure Detection

FTP credentials were detected. !/usr/bin/env python3 -- coding: utf-8 -- """FTP credentials were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FTP Credentials Exposure Detection', 'description': 'FTP...

Emby Login Panel - Detect

Emby login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Emby login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Emby Login Panel - Detect', 'description': 'Emby login panel...

File Browser Dashboard - Unauthenticated Access Detection

File Browser dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """File Browser dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'File Browser Dashboard - Unauthenticated Access...

FineReport 8.0 - Local File Inclusion Detection

FIneReport 8.0 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """FIneReport 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FineReport 8.0 - Local File Inclusion Detection',...

Fortinet FortiMail Login Panel - Detect

Fortinet FortiMail login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiMail login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiMail Login Panel -...

Google Cloud Default Config - Detect

Google Cloud default configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Google Cloud default configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Cloud Default Conf...

Glimpse Diagnostics - Sensitive Data Exposure Detection

Detected Glimpse diagnostics endpoint. Glimpse is a .NET diagnostics tool that reveals detailed request information, server configuration, SQL queries, connection strings, and session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Glimpse diagnostics endpoint.""" from kittysploit...

Cisco Web UI Login - Detect

Detects the presence of Cisco Web UI login panels !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Cisco Web UI login panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cisco Web UI Login -...

Axway SecureTransport Login Panel - Detect

AXWAY SecureTransport login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AXWAY SecureTransport login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Axway SecureTransport Login...

Bagisto Installer Exposure Detection

Bagisto is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Bagisto is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Clave Login Panel - Detect

Clave login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Clave login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Clave Login Panel - Detect', 'description': 'Clave login...

Configuration File - Detect

Multiple configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Configuration File - Detect',...

Allied Telesis Device GUI Login Panel - Detect

Allied Telesis Device GUI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Allied Telesis Device GUI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Allied Telesis Devi...

Angular detect

Angular is a development platform for building mobile and desktop web applications using Typescript/JavaScript and other languages. !/usr/bin/env python3 -- coding: utf-8 -- """Angular is a development platform for building mobile and desktop web applications using Typescript/JavaScript.""" from...

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure Detection

Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. !/usr/bin/env python3 -- coding: utf-8 -- """Acexy Wireless-N WiFi Repeater REV 1.""" from kittysplo...

Rosario Student Information System Unauthenticated SQL Injection Detection

An unauthenticated SQL injection vulnerability in Rosario Student Information System aka rosariosis 8.1 and below allow remote attackers to execute PostgreSQL statements e.g., SELECT, INSERT, UPDATE, and DELETE through /Side.php via the syear parameter. !/usr/bin/env python3 -- coding: utf-8 --...

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect Detection

The Oracle Applications Framework component of Oracle E-Business Suite subcomponent: Popup windows lists of values, datepicker, etc. is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers...

Appsuite Login Panel - Detect

Detects Appsuite Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Appsuite Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Appsuite Login Panel - Detect', 'description'...

WordPress ChurcHope Theme <= 2.1 - Local File Inclusion Detection

WordPress ChurcHope Theme = 2.1 is susceptible to local file inclusion. The vulnerability is caused by improper filtration of user-supplied input passed via the 'file' HTTP GET parameter to the '/lib/downloadlink.php' script, which is publicly accessible. !/usr/bin/env python3 -- coding: utf-8 --...

Cortex XSOAR Login Panel - Detect

Cortex XSOAR login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cortex XSOAR login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cortex XSOAR Login Panel - Detect',...

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities Detection

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. !/usr/bin/env...

WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting Detection

Wordpress plugin forget-about-shortcode-buttons 1.1.1 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress Checklist <1.1.9 - Cross-Site Scripting Detection

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Checklist plugin before 1.""" from kittysploit import from...

Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization Detection

Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifyi...

PyLoad Login - Panel Detection

A Pyload Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Pyload Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PyLoad Login - Panel Detection', 'description': 'A Pyload Login w...

Wowza Streaming Engine Manager Panel - Detect

Wowza Streaming Engine Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wowza Streaming Engine Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wowza Streaming Engin...

Build Properties File Exposure Detection

Detects Build Properties File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Build Properties File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Build Properties File Exposure Detection',...

Salesforce B2C Commerce WebDAV - Detection

Detects Salesforce B2C Commerce WebDAV by checking for specific patterns in a 404 response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Salesforce B2C Commerce WebDAV by checking for specific patterns in a 404 response.""" from kittysploit import from lib.protocols.http.httpclient import...

WordPress GTranslate <2.8.52 - Cross-Site Scripting Detection

WordPress GTranslate plugin before 2.8.52 contains an unauthenticated reflected cross-site scripting vulnerability via a crafted link. This requires use of the hreflang tags feature within a sub-domain or sub-directory paid option. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress GTranslate...

Cisco Adaptive Security Appliance (ASA)/Firepower Threat Defense (FTD) - Local File Inclusion Detection

Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software is vulnerable to local file inclusion due to directory traversal attacks that can read sensitive files on a targeted system because of a lack of proper input validation of URLs in HTTP requests processe...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a...

EVlink City < R8 V3.4.0.1 - Authentication Bypass Detection

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass Detection

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. !/usr/bin/env python3 -- codin...

CommScope Ruckus IoT Controller - Information Disclosure Detection

CommScope Ruckus IoT Controller is susceptible to information disclosure vulnerabilities because a 'service details' API endpoint discloses system and configuration information to an attacker without requiring authentication. This information includes DNS and NTP servers that the devices use for...

ACTi-Video Monitoring - Local File Inclusion Detection

ACTI video surveillance has loopholes in reading any files !/usr/bin/env python3 -- coding: utf-8 -- """ACTI video surveillance has loopholes in reading any files.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...