AVTECH Room Alert Login Panel - Detect

AVTECH Room Alert login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH Room Alert login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AVTECH Room Alert Login Panel -...

Pinata API Key - Expose Detection

Detects Pinata API Key - Expose. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pinata API Key - Expose.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pinata API Key - Expose Detection', 'description': 'Detec...

Craft CMS Detect

Detects Craft CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Craft CMS.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Detect', 'description': 'Detects Craft CMS', 'author': 'KittySploi...

Kavita Login Panel - Detect

Kavita login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kavita login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kavita Login Panel - Detect', 'description': 'Kavita logi...

EJBCA Enterprise Cloud Configuration Wizard - Exposure Detection

Detects exposed EJBCA Enterprise Cloud Installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed EJBCA Enterprise Cloud Installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EJBCA...

SpiderFoot Login Panel - Detect

SpiderFoot login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SpiderFoot login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SpiderFoot Login Panel - Detect', 'description':...

WordPress AMP - Full Path Disclosure Detection

The WordPress AMP - Accelerated Mobile Pages plugin was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated access to the full application path. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress AMP - Accelerated Mobile Pages plugin was detected to be vulnerable t...

Usermin Panel - Detect

Usermin panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Usermin panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Usermin Panel - Detect', 'description': 'Usermin panel was...

Atlassian Jira <7.13.3/8.0.0-8.1.1 - Incorrect Authorization Detection

Atlasssian Jira before version 7.13.3 and from version 8.0.0 before version 8.1.1 is susceptible to incorrect authorization. The ManageFilters.jspa resource allows a remote attacker to enumerate usernames via an incorrect authorization check, thus possibly obtaining sensitive information, modifyi...

WordPress Infusionsoft Gravity Forms <=1.5.11 - Cross-Site Scripting Detection

WordPress plugin Infusionsoft 1.5.11 and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

SolarWinds Orion Login Panel - Detect

SolarWinds Orion login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SolarWinds Orion login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SolarWinds Orion Login Panel - Detect...

Jellyseerr Login Panel - Detect

Detects Jellyseerr Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jellyseerr Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jellyseerr Login Panel - Detect',...

Label Studio - Login Panel Detection

Detects the presence of the Label Studio Login Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Label Studio Login Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Label Studio -...

Snapdrop Detect

Snapdrop panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Snapdrop panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Snapdrop Detect', 'description': 'Snapdrop panel was detected.',...

Sophos Firewall Login Panel - Detect

Sophos Firewall login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sophos Firewall Login Panel - Detect',...

SmartStore Detect

Detects SmartStore Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SmartStore Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SmartStore Detect', 'description': 'Detects SmartStore...

Symfony Debug Mode Detection

A Symfony installations 'debug' interface is enabled, allowing the disclosure and possible execution of arbitrary code. !/usr/bin/env python3 -- coding: utf-8 -- """A Symfony installations 'debug' interface is enabled, allowing the disclosure and possible execution of arbitr.""" from kittysploit...

Coda v.2024Q1 - Cross-Site Scripting Detection

Cross Site Scripting vulnerability in Unit4 Financials by Coda v.2024Q1 allows a remote attacker to escalate privileges via a crafted script to the cols parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross Site Scripting vulnerability in Unit4 Financials by Coda v.""" from kittysploit...

WordPress WP Security Audit Log 3.1.1 - Information Disclosure Detection

WordPress WP Security Audit Log 3.1.1 plugin is susceptible to information disclosure. Access to wp-content/uploads/wp-security-audit-log/ files is not restricted. An attacker can obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding:...

RabbitMQ Management Panel - Detect

RabbitMQ Management panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """RabbitMQ Management panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RabbitMQ Management Panel - Detect',...

AVTECH Video Surveillance Product - Authentication Bypass Detection

AVTECH Video Surveillance Products password disclosure through /cgi-bin/user/Config.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH Video Surveillance Products password disclosure through /cgi-bin/user/Config.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Rexify Configuration - Exposure Detection

Rexfile configuration from the Rex/Rexify automation framework was exposed. These files may contain SSH credentials, server hostnames, private key paths, and other sensitive data. !/usr/bin/env python3 -- coding: utf-8 -- """Rexfile configuration from the Rex/Rexify automation framework was...

OpenVPN Host Header Injection Detection

A vulnerability in OpenVPN Access Server allows remote attackers to inject arbitrary redirection URLs by using the 'Host' HTTP header field. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in OpenVPN Access Server allows remote attackers to inject arbitrary redirection URLs by...

Wordpress - Path Disclosure Detection

Wordpress internal file system path of a WordPress installation is exposed or disclosed to unauthorized users. !/usr/bin/env python3 -- coding: utf-8 -- """Wordpress internal file system path of a WordPress installation is exposed or disclosed to unauthorized users.""" from kittysploit import fro...

Apache Ranger Detection

Detects Apache Ranger Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache Ranger Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Ranger Detection', 'description': 'Detects Apache...

D-Link DIR-610 Devices - Information Disclosure Detection

D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-610 devices allow information...

QloApps - Installation Detection

QloApps Installation Assistant panel exposure. !/usr/bin/env python3 -- coding: utf-8 -- """QloApps Installation Assistant panel exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'QloApps - Installation...

SnapComms Content Manager Panel - Detect

SnapComms Content Manager was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SnapComms Content Manager was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SnapComms Content Manager Panel - Detect',...

Surreal ToDo 0.6.1.2 - Local File Inclusion Detection

Surreal ToDo 0.6.1.2 is vulnerable to local file inclusion via index.php and the content parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Surreal ToDo 0.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Socks5 VPN - Sensitive File Disclosure Detection

Information Leakage in the Socks5 VPN login system of Wheilton e-Ditong, and the administrator account password can be obtained by visiting a specially crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """Information Leakage in the Socks5 VPN login system of Wheilton e-Ditong, and the...

Versa Concerto Actuator Endpoint - Authentication Bypass Detection

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

LibrePhotos Panel - Detect

Detects LibrePhotos Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects LibrePhotos Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LibrePhotos Panel - Detect', 'description': 'Detect...

Apache OFBiz 17.12.03 - Cross-Site Scripting Detection

Apache OFBiz 17.12.03 contains cross-site scripting and unsafe deserialization vulnerabilities via an XML-RPC request. !/usr/bin/env python3 -- coding: utf-8 -- """Apache OFBiz 17.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting Detection

PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting XSS via the "action" parameter of index.php. !/usr/bin/env python3 -- coding: utf-8 -- """PHPJabbers Fundraising Script v1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

IBM Security Access Manager Login Panel - Detect

IBM Security Access Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Security Access Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IBM Security...

JBoss JMX Management Console Login Panel - Detect

JBoss JMX Management Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """JBoss JMX Management Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JBoss JMX...

noVNC Login Panel - Detect

noVNC login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """noVNC login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'noVNC Login Panel - Detect', 'description': 'noVNC login...

Beaver Builder Page Builder - Full Path Disclosure Detection

Beaver Builder Page Builder WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Beaver Builder...

Interact Software Panel - Detect

Interact Software was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Interact Software was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Interact Software Panel - Detect', 'description': 'Interact...

OpenReplay RUM - Tech Detect

Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenReplay formerly Asayer Session Replay & RUM SDK implementation.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Determined AI Panel - Detect

Determined AI, an open-source deep learning training platform that provides distributed training, hyperparameter tuning, and experiment tracking through a web-based UI and a REST/gRPC-gateway API served by the "master" component, was detected by matching the application title and meta description...

WordPress Woody Ad Snippets <2.2.5 - Cross-Site Scripting/Remote Code Execution Detection

WordPress Woody Ad Snippets prior to 2.2.5 is susceptible to cross-site scripting and remote code execution via admin/includes/class.import.snippet.php, which allows unauthenticated options import as demonstrated by storing a cross-site scripting payload for remote code execution. !/usr/bin/env...

Cassia Bluetooth Gateway Panel - Detect

Cassia Bluetooth Gateway Management Platform login page was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Cassia Bluetooth Gateway Management Platform login page was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress Jannah Theme <5.4.5 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.5 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the 'query' POST parameter in its tieajaxsearch AJAX action. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme before 5.""" from kittysploit import from...

Vite Dev Server - Path Traversal in Optimized Deps .map Handling Detection

Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...

Laravel Clockwork - Sensitive Information Exposure Detection

Laravel Clockwork itsgoingd/clockwork was detected as enabled and publicly accessible. When left active in production, it exposes SQL queries, request data, session variables, mail logs, and application internals to any visitor. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel Clockwork...

Cypress Oxygen Configuration Page - Detect

Cypress Oxygen configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cypress Oxygen configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cypress Oxygen Configuratio...

Ruby on Rails Database Configuration File - Detect

Ruby on Rails database configuration file was detected, which may contain database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails database configuration file was detected, which may contain database credentials.""" from kittysploit import from lib.protocols.http.httpclien...

CircleCI SSH Configuration - Detect

CircleCI ssh-config file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """CircleCI ssh-config file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CircleCI SSH Configuration - Detect',...

Concrete Installer Detection

Concrete is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Concrete is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...