WordPress Plugin WPML Version < 4.6.1 Cross-Site Scripting Detection

WordPress Plugin WPML Version 4.6.1 is vulnerable to RXSS via wplang parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WPML Version 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress...

Beaver Builder Page Builder - Full Path Disclosure Detection

Beaver Builder Page Builder WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Beaver Builder...

WordPress Call Now Button - Full Path Disclosure Detection

WordPress Plugin Call Now Button files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Call Now Button files are publicly accessible...

WordPress Data Source for Contact Form 7 - Full Path Disclosure Detection

WordPress Plugin CData Source for Contact Form 7 files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CData Source for Contact Form 7...

WordPress Google Analytics - Full Path Disclosure Detection

Detected WordPress Google Analytics Dashboard Plugin for WordPress by MonsterInsights, potentially revealing analytics data, file paths, and errors. !/usr/bin/env python3 -- coding: utf-8 -- """Detected WordPress Google Analytics Dashboard Plugin for WordPress by MonsterInsights, potentially...

GTranslate < 2.8.11 - Open Redirect Detection

The Translate WordPress with GTranslate WordPress plugin was affected by an Unauthenticated Open Redirect security vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Translate WordPress with GTranslate WordPress plugin was affected by an Unauthenticated Open Redirect secu.""" import ...

WordPress Oxygen-Theme - Local File Inclusion Detection

WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.""" from kittysploit import from...

WordPress Securimage-WP 3.2.4 - Cross-Site Scripting Detection

WordPress Securimage-WP 3.2.4 plugin contains a cross-site scripting vulnerability via siwptest.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials an...

WordPress All-in-One Security <=4.4.1 - Hidden Login Page Exposure Detection

WordPress All-in-One Security plugin through 4.4.1 contains an exposure of the actual URL of the "hidden login page" feature. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress All-in-One Security plugin through 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

WordPress super-forms Plugin Directory Listing Detection

Searches for sensitive directories present in the super-forms plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the super-forms plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WordPress UpdraftPlus - Full Path Disclosure Detection

WordPress Plugin UpdraftPlus files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin UpdraftPlus files are publicly accessible without...

WordPress Yoast SEO - Full Path Disclosure Detection

WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

XAMPP Environment Variables Exposure Detection

printenv.pl file is exposed in XAMPP leaking environment variables. !/usr/bin/env python3 -- coding: utf-8 -- """printenv.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XAMPP Environment Variables Exposure...

XOOPS Installation Page - Exposure Detection

Detects exposed XOOPS Installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed XOOPS Installation page.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XOOPS Installation Page -...

ESMTP - Detect

ESMTP was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ESMTP was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'ESMTP - Detect', 'description': 'ESMTP was detected....

Exim - Detect

Exim can accept messages from remote hosts using SMTP over TCP/IP, and as well as from local processes. It handles local deliveries to mailbox files or to pipes attached to commands, as well as remote SMTP deliveries to other hosts. !/usr/bin/env python3 -- coding: utf-8 -- """Exim can accept...

Gene6 FTP Service - Detect

Gene6 FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gene6 FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Gene6 FTP Service - Detect',...

Hummingbird HCLFTPD Service - Detect

Hummingbird HCLFTPD service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hummingbird HCLFTPD service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name':...

Memcached stats disclosure Detection

Memcached stats is used to return server statistics such as PID, version, connections, etc. !/usr/bin/env python3 -- coding: utf-8 -- """Memcached stats is used to return server statistics such as PID, version, connections, etc.""" import socket from kittysploit import from...

MongoDB - Unauthenticated Access Detection

MongoDB was able to be accessed with no password. Note that MongoDB does not require a password by default. !/usr/bin/env python3 -- coding: utf-8 -- """MongoDB was able to be accessed with no password.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import...

OpenDreambox FTP Service - Detect

OpenDreambox FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenDreambox FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'OpenDreambox F...

SAP Dispatcher - Detect

The SAP Dispatcher is the central process that manages communication between user requests and work processes. !/usr/bin/env python3 -- coding: utf-8 -- """The SAP Dispatcher is the central process that manages communication between user requests and work processes.""" import socket from...

Virtua Software Panel - Detect

Virtua Software panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Virtua Software panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Virtua Software Panel - Detect', 'description':...

VMware Cloud Director Login Panel - Detect

VMware Cloud Director login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Cloud Director login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware Cloud Director Login...

Vodafone Vox UI Login Panel - Detect

Vodafone Vox UI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Vodafone Vox UI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Vodafone Vox UI Login Panel - Detect',...

Visual Studio Code MCP Configuration ("mcp.json") Exposure Detection

Detected exposed VS Code MCP Model Context Protocol configuration files mcp.json which may contain sensitive information including API keys, server endpoints, authentication tokens, and tool configurations for AI assistants and language models. !/usr/bin/env python3 -- coding: utf-8 -- """Detecte...

Visual Studio Code Settings - Credential Exposure Detection

Detected exposed Visual Studio Code configuration files that were accessible over HTTP, which could have led to credential leakage or sensitive workspace disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Visual Studio Code configuration files that were accessible over HTTP...

WAGO PLC Panel - Detect

WAGO PLC panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WAGO PLC panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WAGO PLC Panel - Detect', 'description': 'WAGO PLC panel was...

Webigniter 28.7.23 - Cross-Site Scripting Detection

The value of the redirect request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ycsz3"alert1bn76w was submitted in the redirect parameter. This input was echoed unmodified in the application's response. By using this Java...

Weblate Public Project - Exposure Detection

Weblate instance is publicly accessible. Public exposure of Weblate may lead to unauthorized access to translation projects, potential data leaks, credential exposure, or manipulation of open source localization data. Attackers can view available projects and access sensitive information if prope...

WebTrees Exposed Installation Detection

WebTrees is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """WebTrees is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Web Configuration File - Detect

Web configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Web configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Web Configuration File - Detect', 'description':...

Wooyun - Local File Inclusion Detection

Wooyun is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Wooyun is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wooyun - Local File Inclusion...

WordPress Plugin "AffiliateWP -- Allowed Products" Log Disclosure Detection

Exposed debug log in AffiliateWP Wordpress Plugin !/usr/bin/env python3 -- coding: utf-8 -- """Exposed debug log in AffiliateWP Wordpress Plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Plugin...

WordPress AMP - Full Path Disclosure Detection

The WordPress AMP - Accelerated Mobile Pages plugin was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress AMP - Accelerated Mobile Pages plugin was detected to be vulnerable t...

Wordpress DB Repair Exposed Detection

Discover enabled Wordpress repair page. !/usr/bin/env python3 -- coding: utf-8 -- """Discover enabled Wordpress repair page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress DB Repair Exposed Detection',...

Wordpress directory listing Detection

Directory listing enabled in wordpress. !/usr/bin/env python3 -- coding: utf-8 -- """Directory listing enabled in wordpress.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress directory listing Detection',...

VMware Workspace ONE UEM Airwatch Self-Service Portal - Detect

VMware Workspace ONE UEM Airwatch Self-Service Portal SSP login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Workspace ONE UEM Airwatch Self-Service Portal SSP login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

WoWonder Installation Page - Exposure Detection

Detects exposed WoWonder installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed WoWonder installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WoWonder Installation Page - Exposu...

Advanced Custom Fields (ACF) - Full Path Disclosure Detection

Advanced Custom Fields ACF for WordPress contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Advanced Custom...

WordPress AddToAny Share Buttons Plugin - Full Path Disclosure Detection

The AddToAny Share Buttons plugin for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The AddToAny Share Buttons plugin for WordPress was detected to be vulnerable to Full...

All In One WP Security & Firewall - Full Path Disclosure Detection

All In One WP Security & Firewall WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """All In O...

WordPress Plugin iThemes Security - Full Path Disclosure Detection

WordPress Plugin iThemes Security files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin iThemes Security files are publicly accessible...

WordPress Plugin Enable Media Replace - Log File Exposure Detection

The WordPress plugin "Enable Media Replace" enable-media-replace bundles a ShortPixel-based logger that writes a plugin-specific log file into the WordPress uploads directory, typically as wp-content/uploads/EnableMediaReplace.log. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress plugin...

Wordpress - Path Disclosure Detection

Wordpress internal file system path of a WordPress installation is exposed or disclosed to unauthorized users. !/usr/bin/env python3 -- coding: utf-8 -- """Wordpress internal file system path of a WordPress installation is exposed or disclosed to unauthorized users.""" from kittysploit import fro...

WordPress Plugin Site Kit by Google - Full Path Disclosure Detection

WordPress plugin Site Kit by Google internal file system path is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress plugin Site Kit by Google internal file system path is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress Grimag <1.1.1 - Open Redirection Detection

WordPress Grimag theme before 1.1.1 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Grimag theme befo...

Wordpress Plugin MStore API Detection

Searches for sensitive directories present in the mstore-api plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the mstore-api plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WordPress NextGEN Gallery 1.9.10 - Cross-Site Scripting Detection

WordPress NextGEN Gallery 1.9.10 plugin contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download Detection

WordPress WooCommerce 1.2.7 is susceptible to file download vulnerabilities. The lack of authorization checks in the handledownloads function hooked to admininit could allow unauthenticated users to download arbitrary files from the blog using a path traversal payload. !/usr/bin/env python3 --...