XWiki Platform - Path Traversal Detection

XWiki Platform 4.2-milestone-2 through 16.10.6 contains a path traversal caused by improper access control in jsx and sx endpoints, letting remote attackers read configuration files, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform 4.""" from...

Microweber Information Disclosure Detection

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. !/usr/bin/env python3 -- coding: utf-8 -- """Microweber contains a vulnerability that allows exposure of sensitive information to an...

Alibaba Druid Monitor Unauthorized Access Detection

Alibaba Druid Monitor is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Alibaba Druid Monitor is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Alibaba Druid Monitor Unauthorized Access Detection',...

Hotel Druid 3.0.2 - Cross-Site Scripting Detection

Hotel Druid 3.0.2 contains a cross-site scripting vulnerability in multiple pages which allows for arbitrary execution of JavaScript commands. !/usr/bin/env python3 -- coding: utf-8 -- """Hotel Druid 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Alert Manager - Unauthenticated Access Detection

Alert Manager was able to be accessed with no authentication requirements in place. !/usr/bin/env python3 -- coding: utf-8 -- """Alert Manager was able to be accessed with no authentication requirements in place.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Oracle Enterprise Manager Login Panel - Detect

Oracle Enterprise Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Enterprise Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Enterprise...

Artica Proxy - Unauthenticated LFI Detection

The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to...

RStudio Connect - Open Redirect Detection

RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. !/usr/bin/env python3 -- coding: utf-8 -- """RStudio Connect prior to 2023.""" import re from kittysploit import from...

twitter-server Cross-Site Scripting Detection

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. !/usr/bin/env python3 -- coding: utf-8 -- """twitter-serve...

TeamPass 2.1.27.36 - Improper Authentication Detection

TeamPass 2.1.27.36 is susceptible to improper authentication. An attacker can retrieve files from the TeamPass web root, which may include backups or LDAP debug files, and therefore possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -...

JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS Detection

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jpyearbuilt leads to cross...

nitely/spirit 0.12.3 - Open Redirect Detection

Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Sangfor Application Login - Remote Command Execution Detection

Sangfor application delivery management system login has a remote command execution vulnerability, through which an attacker can obtain server privileges and execute arbitrary commands !/usr/bin/env python3 -- coding: utf-8 -- """Sangfor application delivery management system login has a remote...

Travelpayouts <= 1.1.16 - Open Redirect Detection

The plugin is vulnerable to Open Redirect due to insufficient validation on the travelpayoutsredirect variable. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. !/usr/bin/env python...

Apache S2-032 Struts - Remote Code Execution Detection

Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when dynamic method invocation is enabled, allows remote attackers to execute arbitrary code via method: prefix related to chained expressions. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re fr...

WordPress AI Engine Plugin - Token Exposure Detection

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.""" import r...

Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read Detection

Citrix ShareFile StorageZones aka storage zones Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ShareFile StorageZones aka storage zones Controller versions through at least...

CtrlPanel Installer Exposure Detection

CtrlPanel is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """CtrlPanel is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Eclipse Theia IDE Panel - Detect

Detected Eclipse Theia IDE panel was exposed. Theia is an extensible platform for multi-language Cloud and Desktop IDEs. Exposed panels may have allowed unauthenticated access to development environments and terminal. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Eclipse Theia IDE panel w...

Open WebUI < 0.9.5 - Information Disclosure Detection

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-...

Rekognition Image Validation Debug UI Panel - Detect

Rekognition Image Validation UI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Rekognition Image Validation UI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Rekognition Image...

SMA OpCon Panel - Detect

SMA OpCon was detected — a workload automation and orchestration software. !/usr/bin/env python3 -- coding: utf-8 -- """SMA OpCon was detected — a workload automation and orchestration software.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Razer Sila Gaming Router 2.0.441_api-2.0.418 - Local File Inclusion Detection

Razer Sila Gaming Router 2.0.441api-2.0.418 is vulnerable to local file inclusion which could allow attackers to read arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Razer Sila Gaming Router 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure Detection

WAVLINK WN579 X3 M79X3.V5030.180719 is susceptible to information disclosure in /cgi-bin/ExportAllSettings.sh. An attacker can obtain sensitive router information via a crafted POST request and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

Zyxel NAS Firmware 5.21- Remote Code Execution Detection

Multiple Zyxel network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using th...

GeoServer - Missing Authorization on REST API Index Detection

GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer contains a missing authorization vulnerability that allows...

Vtiger CRM - Detect

Detected a Vtiger CRM web application, a PHP-based platform that enabled businesses to increase sales wins, marketing ROI, and support satisfaction capabilities. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a Vtiger CRM web application, a PHP-based platform that enabled businesses to...

Alerta < 8.1.0 - Authentication Bypass Detection

Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests. !/usr/bin/env python3 -- coding: utf-8 -- """Alerta prior to version 8.""" from kittysploit import from...

WordPress Madara Theme < 2.2.2.1 - Local File Inclusion Detection

Madara WordPress theme = 2.2.2 contains a local file inclusion vulnerability caused by improper sanitization of the 'template' parameter, letting unauthenticated attackers execute arbitrary files on the server, exploit requires crafted request. !/usr/bin/env python3 -- coding: utf-8 -- """Madara...

XWiki REST API - Private Pages Disclosure Detection

A vulnerability in XWiki's REST API allows unauthenticated users to access information about private pages through the pages endpoint. This could lead to disclosure of sensitive information and page metadata. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in XWiki's REST API allows...

Traefik - Open Redirect Detection

Traefik before 1.7.26, 2.2.8, and 2.3.0-rc3 contains an open redirect vulnerability in the X-Forwarded-Prefix header. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding...

System Properties Exposure Detection

System Properties is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """System Properties is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'System Properties Exposure Detection', 'description': 'System...

WordPress Bricks Builder Theme Version Detection

Checks for Bricks Builder Theme versions. !/usr/bin/env python3 -- coding: utf-8 -- """- Checks for Bricks Builder Theme versions.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Bricks Builder...

PhpPgAdmin Version Information - Detect

PhpPgAdmin version information was detected via the intro.php file. !/usr/bin/env python3 -- coding: utf-8 -- """PhpPgAdmin version information was detected via the intro.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery Detection

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication. !/usr/bin/env python3 -- coding...

Member Hero <=1.0.9 - Remote Code Execution Detection

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

WordPress Ad Inserter <2.7.10 - Cross-Site Scripting Detection

WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the htmlelementselection parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ad Inserter plugin before 2.""" from kittysplo...

AVEVA InTouch Access Anywhere Secure Gateway - Local File Inclusion Detection

AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """AVEVA InTouch Access Anywhere Secure Gateway is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

OpenShift OAuth Proxy - Panel Detect

Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login page content. Checks both the default port and port 9001. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login pa...

MasterSAM Star Gate v11 - Local File Inclusion Detection

MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information...

KevinLAB BEMS (Building Energy Management System) - Backdoor Account Detection

KevinLAB BEMS has an undocumented backdoor account, and these sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the solution through the RMI. An attacker could exploit this vulnerability by logging in using the backdoor account with highes...

ILIAS eLearning <7.16 - Open Redirect Detection

ILIAS eLearning before 7.16 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """ILIAS eLearning before 7.""" import...

St. Joe ERP system - SQL Injection Detection

A SQL injection vulnerability exists in the St. Joe ERP system "圣乔ERP系统" that allows unauthenticated remote attackers to execute arbitrary SQL commands via crafted HTTP POST requests to the login endpoint. The application fails to properly sanitize user-supplied input before incorporating it into...

WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting Detection

WordPress amty-thumb-recent-post plugin 8.1.3 contains a cross-site scripting vulnerability via the query string to amtyThumbPostsAdminPg.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress amty-thumb-recent-post plugin 8.""" from kittysploit import from lib.protocols.http.httpclient impo...

Sonarqube with public projects Detection

Sonarqube public projects detected. !/usr/bin/env python3 -- coding: utf-8 -- """Sonarqube public projects detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sonarqube with public projects Detection',...

HexStrike AI MCP Agents - Config Detection

HexStrike AI MCP Agents server config page exposure. !/usr/bin/env python3 -- coding: utf-8 -- """HexStrike AI MCP Agents server config page exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HexStrike AI MCP...

Twonky Server - Exposure Detection

Twonky Server is a media server software that allows streaming of multimedia content over DLNA/UPnP protocols. When exposed to the internet or an untrusted network without proper authentication or access restrictions, it may allow unauthorized users to browse and access media files, interact with...

L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting Detection

L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter. !/usr/bin/env python3 -- coding: utf-8 -- """L-Soft LISTSERV before 16.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FastCGI Configuration - File Disclosure Detection

FastCGI configuration file is exposed and accessible, potentially leading to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """FastCGI configuration file is exposed and accessible, potentially leading to sensitive information disclosure.""" from kittysploit import fro...

RStudio Sign In Panel - Detect

RStudio Sign In panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """RStudio Sign In panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RStudio Sign In Panel - Detect', 'description':...