WatchGuard Fireware AD Helper Component - Credentials Disclosure Detection

WatchGuard Fireware Threat Detection and Response TDR service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext. !/usr/bin/env python3 -- coding: utf-8 --...

rConfig 3.9.4 - SQL Injection Detection

rConfig 3.9.4 and previous versions have unauthenticated compliancepolicies.inc.php SQL injection. Because nodes' passwords are stored in cleartext by default, this vulnerability leads to lateral movement, granting an attacker access to monitored network devices. !/usr/bin/env python3 -- coding:...

D-Link DIR-816L 2.x - Cross-Site Scripting Detection

D-Link DIR-816L devices 2.x before 1.10b04Beta02 contains a cross-site scripting vulnerability. In the file webinc/js/info.php, no output filtration is applied to the RESULT parameter before being printed on the webpage. An attacker can inject arbitrary script in the browser of an unsuspecting us...

Nova Lite < 1.3.9 - Cross-Site Scripting Detection

Nova Lite before 1.3.9 for WordPress is susceptible to reflected cross-site scripting via search.php. !/usr/bin/env python3 -- coding: utf-8 -- """Nova Lite before 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

FHEM 6.0 - Local File Inclusion Detection

FHEM version 6.0 suffers from a local file inclusion vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """FHEM version 6.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FHEM 6.0 - Local File Inclusi...

Mara CMS 7.5 - Cross-Site Scripting Detection

Mara CMS 7.5 allows reflected cross-site scripting in contact.php via the theme or pagetheme parameters. !/usr/bin/env python3 -- coding: utf-8 -- """Mara CMS 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mara C...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

SAP Solution Manager - Open Redirect Detection

SAP Solution Manager contains an open redirect vulnerability via the logoff endpoint. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Solution Manag...

Jira Server and Data Center - Information Disclosure Detection

Jira Server and Data Center is susceptible to information disclosure. An attacker can enumerate users via the QueryComponentRendererValue!Default.jspa endpoint and thus potentially access sensitive information, modify data, and/or execute unauthorized operations, Affected versions are before...

Smartstore <4.1.0 - Open Redirect Detection

Smartstore aka "SmartStoreNET" before 4.1.0 contains an open redirect vulnerability via CommonController.ClearCache, ClearDatabaseCache, RestartApplication, and ScheduleTaskController.Edit. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data,...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation Detection

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection Detection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Maximo Asset Manageme...

Revive Adserver <=5.0.3 - Cross-Site Scripting Detection

Revive Adserver 5.0.3 and prior contains a reflected cross-site scripting vulnerability in the publicly accessible afr.php delivery script. In older versions, it is possible to steal the session identifier and gain access to the admin interface. The query string sent to the www/delivery/afr.php...

Couchbase Server - Broken Access Control Detection

Couchbase Server versions 4.0.0, 4.1.0, 4.1.1, 4.5.0, 4.5.1, 4.6.0-4.6.5, 5.0.0, 5.1.1, 5.5.0, and 5.5.1 contain insecure permissions for the projector and indexer REST endpoints caused by unauthenticated access, letting attackers access administrative APIs without authentication, exploit require...

D-Link DIR-610 Devices - Information Disclosure Detection

D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-610 devices allow information...

SonicWall SonicOS 7.0 - Open Redirect Detection

SonicWall SonicOS 7.0 contains an open redirect vulnerability. The values of the Host headers are implicitly set as trusted. An attacker can spoof a particular host header, allowing the attacker to render arbitrary links, obtain sensitive information, modify data, execute unauthorized operations...

TCExam <= 14.8.1 - Sensitive Information Exposure Detection

When installed following the default/recommended settings, TCExam = 14.8.1 allowed unauthenticated users to access the /cache/backup/ directory, which includes sensitive database backup files. !/usr/bin/env python3 -- coding: utf-8 -- """When installed following the default/recommended settings,...

Draytek VigorConnect 1.6.0-B - Local File Inclusion Detection

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting Detection

The iframe-font-preview.php file of the titan-framework does not properly escape the font-weight and font-family GET parameters before outputting them back in an href attribute, leading to Reflected Cross-Site Scripting issues. !/usr/bin/env python3 -- coding: utf-8 -- """The...

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting Detection

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. !/usr/bin/env python3 -- coding: utf-8 --...

Yoast SEO 16.7-17.2 - Information Disclosure Detection

Yoast SEO plugin 16.7 to 17.2 is susceptible to information disclosure, The plugin discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints, which can help an attacker identify other vulnerabilities or help during the exploitation of other identified...

Joomla! ChronoForums 2.0.11 - Local File Inclusion Detection

Joomla! ChronoForums 2.0.11 avatar function is vulnerable to local file inclusion through unauthenticated path traversal attacks. This enables an attacker to read arbitrary files, for example the Joomla! configuration file which contains credentials. !/usr/bin/env python3 -- coding: utf-8 --...

Node RED Dashboard <2.26.2 - Local File Inclusion Detection

NodeRED-Dashboard before 2.26.2 is vulnerable to local file inclusion because it allows uibase/js/..%2f directory traversal to read files. !/usr/bin/env python3 -- coding: utf-8 -- """NodeRED-Dashboard before 2.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Tiny Java Web Server - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting...

Gnuboard 5 - Cross-Site Scripting Detection

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter.""" from kittysploit import from lib.protocols.http.httpclient import...

PuneethReddyHC action.php SQL Injection Detection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated SQL injection vulnerability exists in PuneethReddy...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection Detection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated SQL injection vulnerability exists in...

Admidio - Cross-Site Scripting Detection

A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious...

HD-Network Realtime Monitoring System 2.0 - Local File Inclusion Detection

Instances of HD-Network Realtime Monitoring System version 2.0 are vulnerable to a Local File Inclusion vulnerability which allows remote unauthenticated attackers to view confidential information. !/usr/bin/env python3 -- coding: utf-8 -- """Instances of HD-Network Realtime Monitoring System...

WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...

Atlassian Jira Seraph - Authentication Bypass Detection

Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also...

Wordpress Profile Builder Plugin Cross-Site Scripting Detection

The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to cross-site scripting due to insufficient escaping and sanitization of the siteurl parameter found in the /assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a...

WordPress Simple File List <3.2.8 - Local File Inclusion Detection

WordPress Simple File List before 3.2.8 is vulnerable to local file inclusion via the eeFile parameter in the /includes/ee-downloader.php due to missing controls which make it possible for unauthenticated attackers retrieve arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

JobMonster < 4.5.2.9 - Cross-Site Scripting Detection

In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """In the theme JobMonster 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Drawio <18.1.2 - Server-Side Request Forgery Detection

Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

SSDP / UPnP Detection

Sends a unicast SSDP M-SEARCH to detect UPnP devices on UDP 1900. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SSDP / UPnP responders.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.ssdp.detectors import probessdp class...

Action Controller Exception - Page Detection

Detects Action Controller Exception - Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Action Controller Exception - Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Action Controller Exception - Page...

Acunetix Login Panel Detection

An Acunetix login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Acunetix login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Acunetix Login Panel Detection', 'description':...

Add DOM EventListener - Detection

Identifies the use of JavaScript addEventListener calls in the DOM. !/usr/bin/env python3 -- coding: utf-8 -- """Identifies the use of JavaScript addEventListener calls in the DOM.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Adobe Connect Username Exposure Detection

Adobe Connect Username is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe Connect Username is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe Connect Username Exposure Detection',...

WordPress Advanced Access Manager < 5.9.9 - Local File Inclusion Detection

WordPress Advanced Access Manager versions before 5.9.9 are vulnerable to local file inclusion and allows attackers to download the wp-config.php file and get access to the database, which is publicly reachable on many servers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Acces...

Adobe AEM CRX Browser Exposure Detection

Detects Adobe AEM CRX Browser Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Adobe AEM CRX Browser Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Browser Exposure Detection',...

AEM Login Status Detection

LoginStatusServlet is exposed, it allows to bruteforce credentials. !/usr/bin/env python3 -- coding: utf-8 -- """LoginStatusServlet is exposed, it allows to bruteforce credentials.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

AEM Secrets - Sensitive Information Disclosure Detection

Possible Juicy Files can be discovered at this endpoint. Search / Grep for secrets like hashed passwords SHA , internal email disclosure etc. !/usr/bin/env python3 -- coding: utf-8 -- """Possible Juicy Files can be discovered at this endpoint.""" from kittysploit import from...

AKHQ Panel Detection

Detects AKHQ Kafka HQ login UI exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detect AKHQ Kafka UI panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "AKHQ Panel Detection", "description": "Detects AKHQ...

alfacgiapi Detection

Searches for sensitive directories present in the alfacgiapi plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the alfacgiapi plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Alibaba Anyproxy fetchBody File - Path Traversal Detection

Alibaba Anyproxy is vulnerable to Path Traversal. !/usr/bin/env python3 -- coding: utf-8 -- """Alibaba Anyproxy is vulnerable to Path Traversal.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Alibaba...

Alibaba Mongoshake Unauth Detection

Detects Alibaba Mongoshake Unauth. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Alibaba Mongoshake Unauth.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Alibaba Mongoshake Unauth Detection', 'description':...

Ambassador API Gateway Diagnostics - Exposure Detection

Detected Ambassador API Gateway diagnostics portal, revealing service mappings, API endpoints, routing configurations, and internal cluster information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Ambassador API Gateway diagnostics portal, revealing service mappings, API endpoints,...