ThinkPHP 5.0.1 - Remote Code Execution Detection

ThinkPHP 5.0.1 allows remote unauthenticated attackers to execute arbitrary code via the 's' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ThinkPH...

Joomla! Component com_janews - Local File Inclusion Detection

A directory traversal vulnerability in the JA News comjanews component 1.0 for Joomla! allows remote attackers to read arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the JA News...

AMPPS by Softaculous Panel - Directory Listing - Detect

AMPPS by Softaculous panel directory listing was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AMPPS by Softaculous panel directory listing was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AMPPS...

RDWeb RemoteApp and Desktop Connections - Web Access Detection

RDWeb RemoteApp and Desktop Connections does not display. !/usr/bin/env python3 -- coding: utf-8 -- """RDWeb RemoteApp and Desktop Connections does not display.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RDWeb...

IceWarp WebMail 11.4.5.0 - Cross-Site Scripting Detection

IceWarp WebMail 11.4.5.0 is vulnerable to cross-site scripting via the language parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp WebMail 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp...

Joomla! Plugin Core Design Scriptegrator - Local File Inclusion Detection

A directory traversal vulnerability in plugins/system/cdscriptegrator/libraries/highslide/js/jsloader.php in the Core Design Scriptegrator plugin 1.4.1 for Joomla! allows remote attackers to read, and possibly include and execute, arbitrary files via directory traversal sequences in the files...

Atlantis Panel - Detect

Atlantis panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Atlantis panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Atlantis Panel - Detect', 'description': 'Atlantis panel was...

SSH Known Hosts File - Detect

SSH known hosts file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SSH known hosts file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SSH Known Hosts File - Detect', 'description': 'SSH...

Splunk Enterprise Login Panel - Detect

Splunk Enterprise login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk Enterprise login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Splunk Enterprise Login Panel -...

HPE AutoPass License Server - Panel Detection

Detected an exposed HPE AutoPass License Server web interface on the default HTTPS port 5814 by probing the /autopass endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed HPE AutoPass License Server web interface on the default HTTPS port 5814 by probing the .""" from...

Oracle HTTPServer12c Detection

Detects Oracle HTTPServer12c. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle HTTPServer12c.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle HTTPServer12c Detection', 'description': 'Detects Oracle...

Verizon Router Panel - Detect

Verizon router panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Verizon router panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Verizon Router Panel - Detect', 'description': 'Veriz...

NETGEAR WAC124 - Authentication Bypass Detection

NETGEAR WAC124 AC2000 routers contain an authentication bypass vulnerability. An attacker can gain access by bypassing proper authentication, thereby making it possible to obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

3CX Management Console - Local File Inclusion Detection

3CX Management Console is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """3CX Management Console is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

ACME mini_httpd <1.30 - Local File Inclusion Detection

ACME minihttpd before 1.30 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """ACME minihttpd before 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ACME minihttpd 1.30 -...

Nginx UI Panel - Detect

Nginx UI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx UI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx UI Panel - Detect', 'description': 'Nginx UI panel was...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the MF Gig Calendar...

Tongda OA Meeting - Unauthorized Access Detection

Tongda Meeting Unauthorized Access were Detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tongda Meeting Unauthorized Access were Detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tongda OA Meeting -...

Detect Terraform Provider

Write Infrastructure as Code - https://www.terraform.io/ !/usr/bin/env python3 -- coding: utf-8 -- """Write Infrastructure as Code - https://www.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Terraform...

Apache ShenYu Admin JWT - Authentication Bypass Detection

Apache ShenYu 2.3.0 and 2.4.0 allow Admin access without proper authentication. The incorrect use of JWT in ShenyuAdminBootstrap allows an attacker to bypass authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Apache ShenYu 2.""" from kittysploit import from lib.protocols.http.httpclient...

Joomla jMarket 5.15 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in test-plugin.php in the Swipe Checkout for WooCommerce plugin 2.7.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the apiurl parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting...

HIKVISION iSecure Center - Information Leak Detection

HIKVISION iSecure Center comprehensive security management platform is an "integrated" and "intelligent" platform. By accessing equipment such as video surveillance, all-in-one card, parking lot, alarm detection and other systems, Hikvision comprehensive security management platform information...

Apache Kyuubi - Detect

Detects a Apache Kyuubi server, a distributed and multi-tenant gateway to provide serverless SQL on data warehouses and lakehouses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Kyuubi server, a distributed and multi-tenant gateway to provide serverless SQL on data wareh.""" from...

Sharp Multifunction Printers - Local File Inclusion Detection

It was observed that Sharp printers are vulnerable to a local file inclusion without authentication. Any attacker can read any file located in the printer. !/usr/bin/env python3 -- coding: utf-8 -- """It was observed that Sharp printers are vulnerable to a local file inclusion without...

XWiki Platform - Information Disclosure Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is a generic wiki platform...

Templately <= 3.1.2 - Broken Access Control Detection

Templately allow an attacker to logout users who signed in to their templately account, so you can sign in your templately account to exploit this vulnerability. Go to http://IP/wordpress/wp-admin/admin.php?page=templately&path=sign-in to sign in then logout. !/usr/bin/env python3 -- coding: utf-...

PraisonAI AgentOS - Information Disclosure Detection

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...

WebSwing REST API Version - Detection

WebSwing REST API version via the /rest/version endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """WebSwing REST API version via the /rest/version endpoint.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebSwin...

Tailon Panel - Detect

Detects Tailon Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Tailon Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tailon Panel - Detect', 'description': 'Detects Tailon Panel ...

JFrog Artifactory Artifacts Exposure Detection

JFrog Artifactory Artifact repository was exposed. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Artifactory Artifact repository was exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JFrog Artifactory...

ElasticSearch v1.1.1/1.2 RCE Detection

The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions and Java code via the source parameter to search. Be aware this only violates the vendor's intended security policy if the user does not run...

WordPress WP-PageNavi - Full Path Disclosure Detection

WordPress WP-PageNavi plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP-PageNavi plugin files are publicly accessible without...

TurnKey OpenVPN Panel - Detect

TurnKey OpenVPN panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TurnKey OpenVPN panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TurnKey OpenVPN Panel - Detect', 'description':...

Gradio - Open Redirect Detection

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

WordPress Age Gate <2.13.5 - Open Redirect Detection

WordPress Age Gate plugin before 2.13.5 contains an open redirect vulnerability via the wphttpreferer parameter after certain actions and after invalid or missing nonces. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute...

Jenkins Users - Exposure Detection

Detected an exposed Jenkins asynchPeople endpoint that discloses user information e.g., users, full names, and profile URLs allowing user enumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed Jenkins asynchPeople endpoint that discloses user information e.""" from...

Internet Multi Server Control Panel - Detect

Internet Multi Server Control Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Internet Multi Server Control Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Internet Multi Server...

WordPress wpForo Forum < 1.9.7 - Open Redirect Detection

WordPress wpForo Forum 1.9.7 is susceptible to an open redirect vulnerability because the plugin did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress wpForo Foru...

Total Web Solutions Panel - Detect

Total Web Solutions panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Total Web Solutions panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Total Web Solutions Panel - Detect',...

SQL Monitor - Discovery Detection

SQL Monitor was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """SQL Monitor was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SQL Monitor - Discovery Detection', 'description': 'SQL Monitor was...

HP iLO Detection

Version of HP iLO !/usr/bin/env python3 -- coding: utf-8 -- """Version of HP iLO.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP iLO Detection', 'description': 'Version of HP iLO', 'author': 'KittySploit Team',...

Jotform API Key Detection

Detects Jotform API Key. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jotform API Key.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jotform API Key Detection', 'description': 'Detects Jotform API...

I-Librarian Panel - Detect

I Librarian panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """I Librarian panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'I-Librarian Panel - Detect', 'description': 'I Libraria...

Jellyfin detected

Detects Jellyfin detected. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jellyfin detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jellyfin detected', 'description': 'Detects Jellyfin detected.',...

LVS DownLoad.aspx - Local File Inclusion (LFI) Detection

LVS lean value management system DownLoad.aspx has an arbitrary file reading vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """LVS lean value management system DownLoad.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Versa Analytics Server Detection

Detects Versa Analytics Server Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Versa Analytics Server Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Versa Analytics Server Detection',...

Lvmeng - UTS Disclosure Detection

Lvmeng UTS was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Lvmeng UTS was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Lvmeng - UTS Disclosure Detection', 'description': 'Lvmeng UTS was...

Mara CMS 7.5 - Cross-Site Scripting Detection

Mara CMS 7.5 allows reflected cross-site scripting in contact.php via the theme or pagetheme parameters. !/usr/bin/env python3 -- coding: utf-8 -- """Mara CMS 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mara C...

Haraj 3.7 - Cross-Site Scripting Detection

Haraj 3.7 contains a cross-site scripting vulnerability in the User Upgrade Form. An attacker can inject malicious script and thus steal authentication credentials and launch other attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Haraj 3.""" from kittysploit import from...