Metinfo 7.0.0 beta - SQL Injection Detection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Metinfo 7.""" from kittysploit import from lib.protocols.http.httpclient...

YouSayToo auto-publishing 1.0 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in yousaytoo.php in YouSayToo auto-publishing plugin 1.0 for WordPress allows remote attackers to inject arbitrary web script or HTML via the submit parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in yousaytoo."""...

Hospital Management System 1.0 - SQL Injection Detection

Hospital Management System 1.0 contains a SQL injection vulnerability via the editid parameter in /HMS/user-login.php. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site...

Popup by Supsystic <1.10.5 - Cross-Site scripting Detection

WordPress Popup by Supsystic before 1.10.5 did not sanitize the tab parameter of its options page before outputting it in an attribute, leading to a reflected cross-site scripting issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Popup by Supsystic before 1.""" from kittysploit import...

Pandora Fms < 3.1.1 - Directory Traversal Detection

Multiple directory traversal vulnerabilities in Pandora FMS before 3.1.1 allow remote attackers to include and execute arbitrary local files via 1 the page parameter to ajax.php or 2 the id parameter to general/pandorahelp.php, and allow remote attackers to include and execute, create, modify, or...

StackPosts Installation Page - Exposure Detection

Detects exposed StackPosts installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed StackPosts installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'StackPosts Installation Page -...

MooDating 1.2 - Cross-Site Scripting Detection

A vulnerability was found in mooSocial mooDating 1.2. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /friends of the component URL Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. !/usr/bin/e...

MinIO Browser Login Panel - Detect

MinIO Browser login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MinIO Browser login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MinIO Browser Login Panel - Detect',...

WordPress Menu Image - Full Path Disclosure Detection

WordPress Plugin Menu Image plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Menu Image plugin files are publicly accessible...

Temenos T24 R20 - Cross-Site Scripting Detection

Temenos T24 release 20 contains a reflected cross-site scripting vulnerability via the routineName parameter at genrequest.jsp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Unauthenticated Mautic Upgrade.php Exposure Detection

Upgrade.php page in Mautic is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Upgrade.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unauthenticated Mautic Upgrade.php Exposure Detection', 'description':...

SecuritySpy Camera Panel - Detect

SecuritySpy Camera panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SecuritySpy Camera panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SecuritySpy Camera Panel - Detect',...

Apache Storm Unauth Detection

Apache Storm instance is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Storm instance is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import lookslikeapachestormsummary, validatejsonprobe class...

Microsoft Exchange Server - Cross-Site Scripting Detection

Microsoft Exchange Server, or OWA, is vulnerable to a cross-site scripting vulnerability in refurl parameter of frowny.asp. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Server, or OWA, is vulnerable to a cross-site scripting vulnerability in refurl parameter o.""" from...

WordPress Twenty Nineteen - Full Path Disclosure Detection

The WordPress Twentytwenty themes was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Twentytwenty themes was detected to be vulnerable to Full Path Disclosure, allowing...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 is susceptible to cross-site scripting via the url parameter at /controller/OnlinePreviewController.java. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Cuppa CMS v1.0 - Local File Inclusion Detection

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php. !/usr/bin/env python3 -- coding: utf-8 -- """CuppaCMS v1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Flarum < 1.8.5 - Open Redirect Detection

Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a trusted domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be...

JFrog Unauthentication Builds Detection

JFrog Builds are exposed to Unauthenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """JFrog Builds are exposed to Unauthenticated users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JFrog Unauthenticatio...

LG-Ericsson iPECS NMS 30M - Local File Inclusion Detection

Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=../ URIs. !/usr/bin/env python3 -- coding: utf-8 -- """Ericsson-LG iPECS NMS 30M allows local file inclusion via ipecs-cm/download?filename=.""" import re from kittysploit import from lib.protocols.http.httpclien...

Apache Hadoop YARN ResourceManager - Remote Code Execution Detection

Apache Hadoop YARN ResourceManager is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Apache...

My Geo Posts Free <= 1.2 - PHP Object Injection Detection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

Linx Sphere - Directory Traversal Detection

A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the component SCS.""" from kittysploit import from...

Craft CMS - Log File Disclosure Detection

Detected exposed Craft CMS log files due to misconfiguration, allowing unauthenticated access to sensitive information including error messages, stack traces, database queries, and potentially credentials or session data. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Craft CMS log...

WordPress Download Manager < 3.3.07 - Unauthenticated Data Exposure Detection

The WordPress Download Manager plugin before version 3.3.07 does not prevent directory listing on web servers that don't use htaccess, allowing unauthorized access to files stored in the download-manager-files directory. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Download Manager...

Thruk 2.40-2 - Cross-Site Scripting Detection

Thruk 2.40-2 contains a cross-site scripting vulnerability via /thruk/cgi-bin/status.cgi?style=combined&title=TITLE in the host or title parameter. An attacker can inject arbitrary JavaScript into status.cgi, leading to a triggered payload when accessed by an authenticated user. !/usr/bin/env...

LibreChat <= 0.7.9 - HTML Injection via Accept-Language Header Detection

danny-avila/librechat 0.7.9 contains a stored XSS caused by improper sanitization of the Accept-Language header, letting logged-in users inject arbitrary HTML into the html lang= tag, exploit requires user to be logged in. !/usr/bin/env python3 -- coding: utf-8 -- """danny-avila/librechat 0."""...

Default IBM HTTP Server Detection

Detects Default IBM HTTP Server. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Default IBM HTTP Server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Default IBM HTTP Server Detection', 'description': 'Detec...

CasaOS < 0.4.4 - Authentication Bypass via Internal IP Detection

CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as root on CasaOS instances. The problem was addressed by improving the detection of client IP addresses in 391dd7f. This patch is part of CasaOS...

All In One WP Security & Firewall - Full Path Disclosure Detection

All In One WP Security & Firewall WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """All In O...

Revive Adserver <5.1.0 - Open Redirect Detection

Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...

FatPipe WARP/IPVPN/MPVPN - Backdoor Account Detection

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain an account named "cmuser" with administrative privileges and no password, letting attackers gain unauthorized admin access, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 --...

PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting Detection

A vulnerability has been found in PHP Jabbers Availability Booking Calendar 5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument sessionid leads to cross site scripting. The attack can be launched...

WordPress Plugin Enable Media Replace - Log File Exposure Detection

The WordPress plugin "Enable Media Replace" enable-media-replace bundles a ShortPixel-based logger that writes a plugin-specific log file into the WordPress uploads directory, typically as wp-content/uploads/EnableMediaReplace.log. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress plugin...

Detect Jenkins in Debug Mode with Stack Traces Enabled

Module identified that the affected host is running an instance of Jenkins in debug mode, as a result stack traces are enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Module identified that the affected host is running an instance of Jenkins in debug mode, as a result stack tr.""" from...

Smartstore <4.1.0 - Open Redirect Detection

Smartstore aka "SmartStoreNET" before 4.1.0 contains an open redirect vulnerability via CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data,...

SQL Monitor - Discovery Detection

SQL Monitor was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """SQL Monitor was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SQL Monitor - Discovery Detection', 'description': 'SQL Monitor was...

WordPress All in One SEO Pack - Full Path Disclosure Detection

All in One SEO Pack for WordPress contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """All in One SEO Pack for...

OPcache Status Page - Detect

OPcache status page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OPcache status page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OPcache Status Page - Detect', 'description': 'OPcache...

Yachtcontrol Webapplication 1.0 - Remote Command Injection Detection

Yachtcontrol Webapplication 1.0 makes it possible to perform direct operating system commands as an unauthenticated user via the "/pages/systemcall.php?command=COMMAND" page and parameter, where COMMAND will be executed and returning the results to the client. Affects Yachtcontrol webservers...

D-Link DIR-868L/817LW - Information Disclosure Detection

D-Link DIR-868L B1-2.03 and DIR-817LW A1-1.04 routers are vulnerable to information disclosure vulnerabilities because certain web interfaces do not require authentication. An attacker can get the router's username and password and other information via a DEVICE.ACCOUNT value for SERVICES in...

NETGEAR - Authentication Bypass Detection

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations...

YeaLink DM 3.6.0.20 - Remote Command Injection Detection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink Device Management DM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Sophos Firewall <=18.5 MR3 - Remote Code Execution Detection

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall version v18.""" from kittysploit import from...

MobileIron Core - Remote Unauthenticated API Access Detection

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, Since CVE-2023-35082 arises from the same place as CVE-2023-35078, specifically the permissive nature of certain entries in the mifs web application’s security filter chain. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint...

Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution Detection

critical unauthenticated remote code execution RCE vulnerability affecting Citrix ADC NetScaler ADC and Citrix Gateway appliances configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy or AAA virtual server. Exploitation can lead to arbitrary code execution. !/usr/bin/env python3 ...

application.yaml detection

Finds Application YAML files which often contain sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Finds Application YAML files which often contain sensitive information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Hikvision - Authentication Bypass Detection

Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0...

Cisco RV132W/RV134W Router - Information Disclosure Detection

Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device via the web interface, which could lead to the disclosure of confidential information. !/usr/bin/env...

Eaton Intelligent Power Manager 1.6 - Directory Traversal Detection

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Eaton Intelligent Power Manager v1.""" import re from kittysplo...