Emby Login Panel - Detect

Emby login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Emby login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Emby Login Panel - Detect', 'description': 'Emby login panel...

File Browser Dashboard - Unauthenticated Access Detection

File Browser dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """File Browser dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'File Browser Dashboard - Unauthenticated Access...

FineReport 8.0 - Local File Inclusion Detection

FIneReport 8.0 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """FIneReport 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FineReport 8.0 - Local File Inclusion Detection',...

Fortinet FortiMail Login Panel - Detect

Fortinet FortiMail login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiMail login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fortinet FortiMail Login Panel -...

Cisco Web UI Login - Detect

Detects the presence of Cisco Web UI login panels !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of Cisco Web UI login panels.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cisco Web UI Login -...

Axway SecureTransport Login Panel - Detect

AXWAY SecureTransport login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AXWAY SecureTransport login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Axway SecureTransport Login...

Bagisto Installer Exposure Detection

Bagisto is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Bagisto is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Clave Login Panel - Detect

Clave login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Clave login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Clave Login Panel - Detect', 'description': 'Clave login...

Allied Telesis Device GUI Login Panel - Detect

Allied Telesis Device GUI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Allied Telesis Device GUI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Allied Telesis Devi...

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure Detection

Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. !/usr/bin/env python3 -- coding: utf-8 -- """Acexy Wireless-N WiFi Repeater REV 1.""" from kittysplo...

Oracle E-Business Suite 12.1.3/12.2.x - Open Redirect Detection

The Oracle Applications Framework component of Oracle E-Business Suite subcomponent: Popup windows lists of values, datepicker, etc. is impacted by open redirect issues in versions 12.1.3, 12.2.3, 12.2.4, 12.2.5 and 12.2.6. These easily exploitable vulnerabilities allow unauthenticated attackers...

Appsuite Login Panel - Detect

Detects Appsuite Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Appsuite Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Appsuite Login Panel - Detect', 'description'...

WordPress ChurcHope Theme <= 2.1 - Local File Inclusion Detection

WordPress ChurcHope Theme = 2.1 is susceptible to local file inclusion. The vulnerability is caused by improper filtration of user-supplied input passed via the 'file' HTTP GET parameter to the '/lib/downloadlink.php' script, which is publicly accessible. !/usr/bin/env python3 -- coding: utf-8 --...

Cortex XSOAR Login Panel - Detect

Cortex XSOAR login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cortex XSOAR login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cortex XSOAR Login Panel - Detect',...

Dolibarr ERP/CRM 3.2 Alpha - Multiple Directory Traversal Vulnerabilities Detection

Multiple directory traversal vulnerabilities in Dolibarr CMS 3.2.0 Alpha allow remote attackers to read arbitrary files and possibly execute arbitrary code via a .. dot dot in the 1 file parameter to document.php or 2 backtopage parameter in a create action to comm/action/fiche.php. !/usr/bin/env...

WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting Detection

Wordpress plugin forget-about-shortcode-buttons 1.1.1 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

WordPress Checklist <1.1.9 - Cross-Site Scripting Detection

WordPress Checklist plugin before 1.1.9 contains a cross-site scripting vulnerability. The fill parameter is not correctly filtered in the checklist-icon.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Checklist plugin before 1.""" from kittysploit import from...

Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization Detection

Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifyi...

PyLoad Login - Panel Detection

A Pyload Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Pyload Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PyLoad Login - Panel Detection', 'description': 'A Pyload Login w...

Wowza Streaming Engine Manager Panel - Detect

Wowza Streaming Engine Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wowza Streaming Engine Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wowza Streaming Engin...

Build Properties File Exposure Detection

Detects Build Properties File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Build Properties File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Build Properties File Exposure Detection',...

Salesforce B2C Commerce WebDAV - Detection

Detects Salesforce B2C Commerce WebDAV by checking for specific patterns in a 404 response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Salesforce B2C Commerce WebDAV by checking for specific patterns in a 404 response.""" from kittysploit import from lib.protocols.http.httpclient import...

Advantech R-SeeNet - Cross-Site Scripting Detection

Advantech R-SeeNet contains a cross-site scripting vulnerability in the devicegraphpage.php script via the deviceid parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Advantech R-SeeNet contains a...

EVlink City < R8 V3.4.0.1 - Authentication Bypass Detection

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass Detection

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. !/usr/bin/env python3 -- codin...

CommScope Ruckus IoT Controller - Information Disclosure Detection

CommScope Ruckus IoT Controller is susceptible to information disclosure vulnerabilities because a 'service details' API endpoint discloses system and configuration information to an attacker without requiring authentication. This information includes DNS and NTP servers that the devices use for...

ACTi-Video Monitoring - Local File Inclusion Detection

ACTI video surveillance has loopholes in reading any files !/usr/bin/env python3 -- coding: utf-8 -- """ACTI video surveillance has loopholes in reading any files.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability via the index.php/admin/index/ 'error' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atma...

EventON Lite < 2.1.2 - Arbitrary File Download Detection

The plugin does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the numeric id of the post...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting Detection

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Icewarp Icearp v10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

PrestaShop TshirteCommerce - Directory Traversal Detection

The Custom Product Designer tshirtecommerce module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files. !/usr/bin/env python3 -- coding: utf-8 -- """The Custom...

PrestaShop tshirtecommerce - Directory Traversal Detection

The Custom Product Designer tshirtecommerce module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files. !/usr/bin/env python3 -- coding: utf-8 -- """The Custom...

PHPJabbers Food Delivery Script - SQL Injection Detection

PHPJabbers Food Delivery Script 3.0 has a SQL injection SQLi vulnerability in the "q" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHPJabbers Food Delivery Script v3.0 - SQL Injection Detection

PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Food Delivery Script v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Ametys CMS Information Disclosure Detection

Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml and similar pathnames for other languages via the auto-completion plugin, which contain all characters typed by all users, including the content of...

PMB 7.4.6 - Cross-Site Scripting Detection

PMB 7.4.6 contains a cross-site scripting vulnerability via the query parameter at /admin/convert/exportz3950new.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authenticatio...

GDidees CMS v3.9.1 - Arbitrary File Download Detection

GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /admin/imgdownload.php. !/usr/bin/env python3 -- coding: utf-8 -- """GDidees CMS v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

LearnPress Plugin < 4.2.0 - Local File Inclusion Detection

Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.1.7.3.2 versions. !/usr/bin/env python3 -- coding: utf-8 -- """Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin = 4.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Thinkphp Lang - Local File Inclusion Detection

ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled langswitchon=true. An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php...

Bank Locker Management System - Cross-Site Scripting Detection

A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate...

Flatpress < 1.3 - Path Traversal Detection

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. !/usr/bin/env python3 -- coding: utf-8 -- """Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Welcart eCommerce <=2.7.7 - Local File Inclusion Detection

Welcart eCommerce 2.7.7 and before are vulnerable to unauthenticated local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Welcart eCommerce 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

ILIAS eLearning <7.16 - Open Redirect Detection

ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """ILIAS eLearning before 7.""" import...

POP3 Protocol - Detect

POP3 protocol was detected. !/usr/bin/env python3 -- coding: utf-8 -- """POP3 protocol was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'POP3 Protocol - Detect',...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...

Netris Dashboard Panel - Detect

Netris Dashboard panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Netris Dashboard panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Netris Dashboard Panel - Detect', 'description':...

Cherokee HTTPD <=0.5 - Cross-Site Scripting Detection

Cherokee HTTPD 0.5 and earlier contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML via a malformed request that generates an HTTP 400 error, which is not properly handled when the error message is generated. !/usr/bin/env python3 --...

JavaScript Environment Configuration - Detect

Multiple common JavaScript environment configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple common JavaScript environment configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SolarWinds Serv-U File Server Panel - Detect

SolarWinds Serv-U File Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Serv-U File Server panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SolarWinds...