ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting Detection

The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not sanitise and escape a paramete...

FacturaScripts Installer Exposure Detection

FacturaScripts is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """FacturaScripts is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

Service Finder Bookings - Authentication Bypass Detection

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. !/usr/bin/env python3 -- coding: utf-8 -- """Service Finder Bookin...

FastAPI Docs Panel - Detect

FastAPI Docs panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FastAPI Docs panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FastAPI Docs Panel - Detect', 'description': 'FastAPI Doc...

AspNet Version Disclosure - Detect

Detects version disclosed via 'X-AspNet-Version' header. !/usr/bin/env python3 -- coding: utf-8 -- """Detects version disclosed via 'X-AspNet-Version' header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Token Json File Disclosure Detection

Internal token.json file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Internal token.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Token Json File Disclosure Detection', 'description': 'Internal...

AppCms Detect

Detects AppCms Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AppCms Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AppCms Detect', 'description': 'Detects AppCms Detect.', 'author':...

Adobe AEM Debugging Client Libraries Detection

Detects Adobe AEM Debugging Client Libraries. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM Debugging Client Libraries.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Debugging Client...

PrestaShop tshirtecommerce - Directory Traversal Detection

The Custom Product Designer tshirtecommerce module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files. !/usr/bin/env python3 -- coding: utf-8 -- """The Custom...

WordPress WPML Multilingual CMS < 4.6.1 - Cross-Site Scripting Detection

The WPML Multilingual CMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting XSS in versions prior to 4.6.1. The plugin does not escape some URL attributes before outputting them to a page, allowing attackers to inject malicious JavaScript which may be executed in the browser of...

WordPress Members / Membership & User Role Editor Plugin - Error Log Disclosure Detection

WordPress Members plugin is vulnerable to error log disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Members plugin is vulnerable to error log disclosure via direct access to plugin files.""" from kittysploit import from...

WS_FTP Server Web Transfer - Panel Detect

WSFTP Server Web Transfer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WSFTP Server Web Transfer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WSFTP Server Web Transfer - Pan...

Atlassian JIRA Setup - Installer Detection

Atlassian JIRA is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian JIRA is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

Wavlink - Improper Access Control Detection

Wavlink WL-WN530H4 M30H4.V5030.210121 is susceptible to improper access control in the component /cgi-bin/ExportLogs.sh. An attacker can download configuration data and log files, obtain admin credentials, and potentially execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

Listmonk Installer Exposure Detection

Listmonk is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Listmonk is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Eclipse Jetty - Directory Listing Enabled Detection

Eclipse Jetty server has directory listing enabled, which exposes the directory structure and file names to unauthenticated users. This can reveal sensitive files, backup files, configuration files, and aid attackers in reconnaissance. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting Detection

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting Detection

Wordpress Gwyn's Imagemap Selector plugin 0.3.3 and prior contains a reflected cross-site scripting vulnerability. It does not sanitize the id and class parameters before returning them back in attributes. !/usr/bin/env python3 -- coding: utf-8 -- """Wordpress Gwyn's Imagemap Selector plugin 0.""...

Laravel Horizon Dashboard - Unauthenticated Detection

Laravel Horizon Dashboard unauthenticated was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel Horizon Dashboard unauthenticated was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Laravel...

Hrsale 2.0.0 - Local File Inclusion Detection

Hrsale 2.0.0 is vulnerable to local file inclusion. This exploit allow you to download any readable file from server without permission and login session !/usr/bin/env python3 -- coding: utf-8 -- """Hrsale 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclien...

OA E-Weaver SignatureDownLoad - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the E-Weaver SignatureDownLoad interface of Panwei OA. An attacker can read any file on the server through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the E-Weaver...

BMC Discovery Outpost Admin Panel - Detect

BMC Discovery Outpost admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BMC Discovery Outpost admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BMC Discovery Outpost Admin...

application.yaml detection

Finds Application YAML files which often contain sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Finds Application YAML files which often contain sensitive information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

.buildpath - File Disclosure Detection

Publicly accessible /.buildpath configuration file was detected, which may expose project structure or sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Publicly accessible /.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ChirpStack LoRaWAN Detection

Detects the presence of ChirpStack LoRaWAN Network-Server by identifying unique page characteristics in the HTML response. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of ChirpStack LoRaWAN Network-Server by identifying unique page characteristics in the HT.""" from kittysplo...

Axway API Manager Panel - Detect

Axway API Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Axway API Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Axway API Manager Panel - Detect', 'description...

Bulma CSS Framework - Detect

Detects the presence of the Bulma CSS Framework. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Bulma CSS Framework.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bulma CSS...

VTScada - Internet Client Panel Detection

VTScada by Trihedral Engineering is a SCADA platform used in water/ wastewater, oil and gas, and utilities. The Internet Client feature exposes a browser-based view of process data, and is commonly deployed by municipal water systems across North America. !/usr/bin/env python3 -- coding: utf-8 --...

Well-Known MTA-STS Policy Detection

Detects SMTP MTA-STS policy file RFC 8461. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SMTP MTA-STS policy file RFC 8461.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Well-Known MTA-STS Policy Detection',...

owncloud Config - Detect

owncloud configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """owncloud configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'owncloud Config - Detect'...

UnRaid <=6.80 - Remote Code Execution Detection

UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. !/usr/bin/env python3 -- coding: utf-8 -- """UnRaid =6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UnRaid =6.80 - Remote Code...

Laravel Sanctum - Stateful Domain CSRF Misconfiguration Detection

Laravel Sanctum's SPA authentication uses cookie-based session authentication for first-party single-page applications. The /sanctum/csrf-cookie endpoint issues XSRF-TOKEN cookies to requesting origins. When SANCTUMSTATEFULDOMAINS is misconfigured with wildcard or overly permissive values, the...

ApostropheCMS - Detect

Detected the presence of ApostropheCMS, a full-stack content management system built on Node.js and MongoDB. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of ApostropheCMS, a full-stack content management system built on Node.""" import re from kittysploit import from...

Tomcat Exposed - Detect

An Apache Tomcat instance was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Apache Tomcat instance was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tomcat Exposed - Detect', 'description': 'A...

Jupyter Lab - Unauthenticated Access Detection

JupyterLab was able to be accessed without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JupyterLab was able to be accessed without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jupyt...

mooDating 1.2 - Cross-site scripting Detection

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. !/usr/bin/env python3 -...

Jalios JCMS Login Panel - Detect

Jalios JCMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jalios JCMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jalios JCMS Login Panel - Detect', 'description...

ThinkCMF Panel - Detect

ThinkCMF panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkCMF panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ThinkCMF Panel - Detect', 'description': 'ThinkCMF panel was...

Joe Editor DEADJOE File - Exposure Detection

Detected Deadjoe file,this file was created by Joe's Own Editor when a session terminated abnormally. It contained the full contents of the file being edited at the time of the crash, potentially exposing sensitive information such as passwords, configuration files, or credentials. !/usr/bin/env...

Metabase Installer - Exposure Detection

Detected Metabase installer page, allowing unauthorized database setup and configuration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Metabase installer page, allowing unauthorized database setup and configuration.""" from kittysploit import from lib.protocols.http.httpclient import...

Beaver Builder Page Builder - Full Path Disclosure Detection

Beaver Builder Page Builder WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Beaver Builder...

Apache Apollo Panel - Detect

Detects Apache Apollo Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache Apollo Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Apollo Panel - Detect', 'description':...

Webbdesign SL-Studio - Local File Inclusion Detection

Webbdesign SL-Studio is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Webbdesign SL-Studio is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

SAPControl Webmethods - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the GetInstanceProperties method without requiring authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface...

Kerio Control v9.2.5 - CRLF Injection Detection

Kerio Control, formerly known as Kerio WinRoute Firewall, has been found vulnerable to multiple HTTP Response Splitting vulnerabilities in product affecting versions 9.2.5 !/usr/bin/env python3 -- coding: utf-8 -- """Kerio Control, formerly known as Kerio WinRoute Firewall, has been found...

SendGrid Env File Exposure Detection

SendGrid file is exposed containing environment variables. !/usr/bin/env python3 -- coding: utf-8 -- """SendGrid file is exposed containing environment variables.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

UniFi Network Application CVE-2026-22557 — path traversal file read

Exploits CVE-2026-22557: unauthenticated arbitrary file read through the guest portal pageerror parameter on /guest/s//wechat/sign and /login. Uses lib.protocols.http.lfi for one-shot reads or an interactive LFI shell. Pair with scanner/http/unificve202622557. Note: full OS file disclosure...

Drupal PostgreSQL SQLi (CVE-2026-9082)

CVE-2026-9082 SA-CORE-2026-004: PostgreSQL-only blind SQL injection via JSON:API filter value array keys or POST /user/login name keys. translateCondition concatenates the key into a PDO placeholder; 0||1/CASE WHEN predicate THEN 0 ELSE 1 END turns true predicates into HTTP 500 divisionbyzero and...

FortiClient EMS CVE-2026-21643 pre-auth SQLi confirmation

Actively confirms CVE-2026-21643 FortiClient EMS 7.4.4 multi-tenant by injecting SQL through the Site HTTP header. Default path is error-based GET /api/v1/initconsts safe, no lockout. Optional time-based POST /api/v1/auth/signin locks out after 3 attempts. !/usr/bin/env python3 -- coding: utf-8 -...

ZoneMinder CVE-2026-27470 second-order SQLi

Exploits CVE-2026-27470: authenticated second-order SQL injection in ZoneMinder getNearEvents web/ajax/status.php. Stores a UNION payload in Event Name/Cause parameterized write, then triggers via entity=nearevents. Affected: = 1.36.37 and 1.37.61–1.38.0. Fixed: 1.36.38 / 1.38.1. Requires Events...