SmarterTools SmarterTrack - Cross-Site Scripting Detection

Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools SmarterTrack 100.0.8019.14010. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS vulnerability in SmarterTools SmarterTrack This issue affects: SmarterTools Smarter.""" from...

Roxy-WI < 6.1.1.0 - Remote Code Execution Detection

Roxy-WI before 6.1.1.0 is susceptible to remote code execution. System commands can be run remotely via the subprocessexecute function without processing the inputs received from the user in the /app/options.py file. !/usr/bin/env python3 -- coding: utf-8 -- """Roxy-WI before 6.""" import re from...

VMware - Local File Inclusion Detection

VMware Workspace ONE Access, Identity Manager, and Realize Automation are vulnerable to local file inclusion because they contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access withou...

Microweber <1.3.2 - Cross-Site Scripting Detection

Code Injection in on search.php?keywords= GitHub repository microweber/microweber prior to 1.3.2. !/usr/bin/env python3 -- coding: utf-8 -- """Code Injection in on search.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name...

WWBN AVideo 11.6 - Cross-Site Scripting Detection

WWBN AVideo 11.6 contains a cross-site scripting vulnerability in the footer alerts functionality via the 'msg' parameter, which is inserted into the document with insufficient sanitization. !/usr/bin/env python3 -- coding: utf-8 -- """WWBN AVideo 11.""" from kittysploit import from...

Bitrix Component - Cross-Site Scripting Detection

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim ha...

Phpmyfaq v3.1.11 - Cross-Site Scripting Detection

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized. !/usr/bin/env python3 -- coding: utf-8 -- """Phpmyfaq v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Modoboa < 2.1.0 - Improper Authorization Detection

Improper Authorization in GitHub repository modoboa/modoboa prior to 2.1.0. !/usr/bin/env python3 -- coding: utf-8 -- """Improper Authorization in GitHub repository modoboa/modoboa prior to 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Joomla! Webservice - Password Disclosure Detection

An issue was discovered in Joomla! 4.0.0 through 4.2.7. An improper access check allows unauthorized access to webservice endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered in Joomla! 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

mojoPortal 2.7.0.0 - Cross-Site Scripting Detection

mojoPortal 2.7.0.0 contains a cross-site scripting vulnerability in the FileDialog.aspx component, which can allow an attacker to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal 2.""" from...

OURPHP <= 7.2.0 - Cross Site Scripting Detection

OURPHP = 7.2.0 is vulnerable to Cross Site Scripting XSS via /client/manage/ourphptz.php. !/usr/bin/env python3 -- coding: utf-8 -- """OURPHP = 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OURPHP = 7.2.0 - Cros...

OURPHP <= 7.2.0 - Cross Site Scripting Detection

OURPHP = 7.2.0 is vulnerale to Cross Site Scripting XSS via /client/manage/ourphpout.php. !/usr/bin/env python3 -- coding: utf-8 -- """OURPHP = 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OURPHP = 7.2.0 - Cros...

BlogEngine CMS - Open Redirect Detection

Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect !/usr/bin/env python3 -- coding: utf-8 -- """Blogengine.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BlogEngine CMS - Open Redirect...

Jeecg P3 Biz Chat - Local File Inclusion Detection

Jeecg P3 Biz Chat 1.0.5 allows remote attackers to read arbitrary files through specific parameters. !/usr/bin/env python3 -- coding: utf-8 -- """Jeecg P3 Biz Chat 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

JeecgBoot 3.5.0 - SQL Injection Detection

jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. !/usr/bin/env python3 -- coding: utf-8 -- """jeecg-boot 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

FOSSBilling < 0.5.3 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository fossbilling/fossbilling prior to 0.""" from kittysploit import from lib.protocols.http.httpclien...

EyouCms v1.6.3 - Information Disclosure Detection

EyouCms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custommodelpath/recruit.filelist.txt. !/usr/bin/env python3 -- coding: utf-8 -- """EyouCms v1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Nodogsplash - Directory Traversal Detection

Nodogsplash product was affected by a directory traversal vulnerability that also impacted the OpenWrt product. This vulnerability was addressed in Nodogsplash version 5.0.1. Exploiting this vulnerability, remote attackers could read arbitrary files from the target system. !/usr/bin/env python3 -...

PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier...

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting Detection

PhpJabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting XSS via the keyword parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PhpJabbers PHP Forum Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting Detection

A vulnerability was found in SPA-Cart eCommerce CMS 1.9.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /search. The manipulation of the argument filterbrandid/filterprice leads to cross site scripting. The attack may be launched remotely...

DedeCMS 5.7.87 - Directory Traversal Detection

Directory traversal vulnerability in DedeCMS 5.7.87 allows reading sensitive files via the $activepath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Directory traversal vulnerability in DedeCMS 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Purchase Order Management v1.0 - SQL Injection Detection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/viewdetails.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is...

Oracle Peoplesoft - Unauthenticated File Read Detection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component- Portal. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Securepoint UTM - Leaking Remote Memory Contents Detection

An issue was discovered in SecurePoint UTM before 12.2.5.1. The firewall's endpoint at /spcgi.cgi allows information disclosure of memory contents to be achieved by an authenticated user. Essentially, uninitialized data can be retrieved via an approach in which a sessionid is obtained but not use...

Temenos T24 R20 - Cross-Site Scripting Detection

Temenos T24 release 20 contains a reflected cross-site scripting vulnerability via the routineName parameter at genrequest.jsp. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Nuovo Spreadsheet Reader 0.5.11 - Local File Inclusion Detection

A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the File parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A Local File inclusion vulnerability in test.""" import re from kittysploit import from...

Repetier Server - Directory Traversal Detection

Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLost.php. !/usr/bin/env python3 -- coding: utf-8 -- """Repetier Server through 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Kyocera TASKalfa printer - Path Traversal Detection

CCRX has a Path Traversal vulnerability. Path Traversal is an attack on web applications. By manipulating the value of the file path, an attacker can gain access to the file system, including source code and critical system settings. !/usr/bin/env python3 -- coding: utf-8 -- """CCRX has a Path...

Webkul QloApps 1.6.0 - Cross-site Scripting Detection

An unauthenticated Cross-Site Scripting XSS vulnerability found in Webkul QloApps 1.6.0 allows an attacker to obtain a user's session cookie and then impersonate that user via POST controller parameter. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated Cross-Site Scripting XSS...

Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting Detection

A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php !/usr/bin/env python3 -- coding: utf-8 -- """A Cross Site Scripting XSS vulnerability in Adiscon Aiscon LogAnalyzer through 4.""" from...

Issabel PBX 4.0.0-6 - Directory Listing Detection

An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory !/usr/bin/env python3 -- coding: utf-8 -- """An issue in issabel-pbx v.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting Detection

PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting XSS via the "action" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Fundraising Script v1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

mojoPortal v.2.7.0.0 - Cross-Site Scripting Detection

Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in the Help.aspx component. !/usr/bin/env python3 -- coding: utf-8 -- """Cross Site Scripting vulnerability in mojoPortal v.""" from kittysploit import from...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in the q parameter on search function of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scriptin...

PlayTube 3.0.1 - Information Disclosure Detection

A vulnerability was found in PlayTube 3.0.1 and classified as problematic. This issue affects some unknown processing of the component Redirect Handler. The manipulation leads to information disclosure. The attack may be initiated remotely. !/usr/bin/env python3 -- coding: utf-8 -- """A...

AudioCodes Device Manager Express - SQL Injection Detection

An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the processlogin.php login form. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered in AudioCodes Device Manager Express through 7."...

WordPress Transposh <=1.0.8.1 - Information Disclosure Detection

WordPress Transposh plugin through is susceptible to information disclosure via the AJAX action tphistory, which is intended to return data about who has translated a text given by the token parameter. However, the plugin also returns the user's login name as part of the userlogin attribute. If a...

Zoho ManageEngine - Access Control Bypass Detection

Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs for SSOutAction. SSLAction. LicenseMgr. GetProductDetails. GetDashboard. FetchEvents. and Synchronize via the ../RestAPI...

Parallels H-Sphere 3.6.1713 - Cross-Site Scripting Detection

Parallels H-Sphere 3.6.1713 contains a cross-site scripting vulnerability via the indexen.php 'from' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Parallels H-Sphere 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

WAVLINK WN530HG4 - Improper Access Control Detection

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd and thereby possibly obtain sensitive information, modify data, and/or execute...

Dapr Dashboard 0.1.0-0.10.0 - Improper Access Control Detection

Dapr Dashboard 0.1.0 through 0.10.0 is susceptible to improper access control. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Dapr Dashboard 0.""" from kittysploit import from...

Cuppa CMS v1.0 - Local File Inclusion Detection

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php. !/usr/bin/env python3 -- coding: utf-8 -- """CuppaCMS v1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

MotionEye Config Info Disclosure Detection

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. !/usr/bin/env python3 -- coding: utf-8 -- """MotionEye v0.""" from kittysploit import from...

Complete Online Job Search System 1.0 - Cross-Site Scripting Detection

Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch. !/usr/bin/env python3 -- coding: utf-8 -- """Complete Online Job Search System 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

School Dormitory Management System 1.0 - SQL Injection Detection

School Dormitory Management System 1.0 contains a SQL injection vulnerability via accounts/paymenthistory.php:31. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via SolarAiConf.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch...

VMware vRealize Log Insight < v8.10.2 - Information Disclosure Detection

VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """VMware vRealize Log Insight contains an Information Disclosure...

WAVLINK WN530HG4 - Improper Access Control Detection

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...