SunOS 5.8 FTP Service - Detect

SunOS 5.8 FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SunOS 5.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'SunOS 5.8 FTP Service - Detect', 'description':...

Shield Security WP Plugin <= 18.5.9 - Local File Inclusion Detection

The Shield Security Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the renderactiontemplate parameter. This makes it possible for unauthenticated attacker to include and execute PHP fil...

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure Detection

Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. !/usr/bin/env python3 -- coding: utf-8 -- """Acexy Wireless-N WiFi Repeater REV 1.""" from kittysplo...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

DocuWare - Detect

DocuWare panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """DocuWare panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DocuWare - Detect', 'description': 'DocuWare panel was detected.'...

QuestDB Console - Detect

QuestDB console was detected. !/usr/bin/env python3 -- coding: utf-8 -- """QuestDB console was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'QuestDB Console - Detect', 'description': 'QuestDB console was...

UFIDA NC Portal - Arbitrary File Read Detection

There is any file reading in the getFileLocal interface of UFIDA Mobile System Management. !/usr/bin/env python3 -- coding: utf-8 -- """There is any file reading in the getFileLocal interface of UFIDA Mobile System Management.""" from kittysploit import from lib.protocols.http.httpclient import...

Mastodon - Open Redirect Detection

Mastodon version 4.5.8, 4.4.15, 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. !/usr/bin/env python3 -- coding: utf-8 -- """Mastodon version 4.""" import re from kittysploit import from...

Deep Sea Electronics DSE 855 Generator Controller - Detect

Deep Sea Electronics DSE 855 is a generator/mains automatic transfer switch ATS controller with a built-in HTTP web server for remote monitoring and configuration of generator control systems. The interface is commonly exposed on port 8090 and requires no authentication by default. !/usr/bin/env...

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery Detection

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication. !/usr/bin/env python3 -- coding...

Meilisearch - Detect

An open-source, blazingly fast, and hyper-relevant search engine that will improve your search experience. !/usr/bin/env python3 -- coding: utf-8 -- """An open-source, blazingly fast, and hyper-relevant search engine that will improve your search experience.""" from kittysploit import from...

Symfony _fragment - Detect

Symfony servers support a "/fragment" command that allows clients to provide custom PHP commands and return the HTML output. !/usr/bin/env python3 -- coding: utf-8 -- """Symfony servers support a "/fragment" command that allows clients to provide custom PHP commands and return t.""" from...

WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting Detection

WordPress Hero Maps Pro 2.1.0 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

HCM Cloud - Arbitrary File Read Detection

HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability.""" import re from kittysploit import from...

Seagate NAS Login - Detect

Seagate NAS - SEAGATE Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS - SEAGATE Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seagate NAS Login - Detect',...

Free5gc 3.2.1 - Information Disclosure Detection

Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Free5gc 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

WordPress Gallery <2.0.0 - Cross-Site Scripting Detection

WordPress Gallery plugin before 2.0.0 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, available to both unauthenticated and authenticated users. !/usr/bin/env python3 -- coding: utf-8...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting Detection

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Icewarp Icearp v10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Atarim < 4.2.2 - Sensitive Information Exposure Detection

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -...

Telaen => v1.3.1 - Open Redirect Detection

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """Open Redirection Vulnerability in the redir.""" import re from kittysploit import from...

twitter-server Cross-Site Scripting Detection

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. !/usr/bin/env python3 -- coding: utf-8 -- """twitter-serve...

Microsoft SharePoint - Master Page Disclosure Detection

Detected exposed SharePoint Master Page endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint Master Page endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft SharePoint ...

ICT Protege WX Login Panel - Detect

Detects ICT Protege WX Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ICT Protege WX Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ICT Protege WX Login Panel -...

Supertokens Login Panel - Detect

A Supertokens login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Supertokens login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Supertokens Login Panel - Detect',...

Dotclear Admin Login Panel - Detect

Dotclear admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dotclear admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dotclear Admin Login Panel - Detect',...

GlobalSCAPE Secure FTP Service - Detect

GlobalSCAPE Secure FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GlobalSCAPE Secure FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name':...

HOOBS Panel - Detect

HOOBS is a home automation platform that bridges HomeKit and non-HomeKit devices. !/usr/bin/env python3 -- coding: utf-8 -- """HOOBS is a home automation platform that bridges HomeKit and non-HomeKit devices.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Ruby on Rails - CRLF Injection and Cross-Site Scripting Detection

Ruby on Rails 6.0.0-6.0.3.1 contains a CRLF issue which allows JavaScript to be injected into the response, resulting in cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Seeyon OA A6 createMysql.jsp Database - Information Disclosure Detection

Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL. !/usr/bin/env python3 -- coding: utf-8 -- """Seeyon OA A6 has leaked sensitive database information.""" import re from kittysploit import from...

WordPress Plugin SG Optimizer - Full Path Disclosure Detection

WordPress Plugin SG Optimizer Plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin SG Optimizer Plugin files are publicly...

YzmCMS Login Panel - Detect

YzmCMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """YzmCMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YzmCMS Login Panel - Detect', 'description': 'YzmCMS logi...

Fortinet FortiAnalyzer - Login Panel Detection

Fortinet FortiAnalyzer is a centralised log management and analytics platform for Fortinet security devices. The web management console is commonly internet-exposed on ports 443, 10443, 9443, or 4443. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiAnalyzer is a centralised log...

Forcepoint Appliance Detection

Detects Forcepoint Appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Forcepoint Appliance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Forcepoint Appliance Detection', 'description': 'Detects...

WordPress NativeChurch Theme - Local File Inclusion Detection

WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.""" from kittysploit import from lib.protocols.http.httpclient import...

Pterodactyl game server - Panel Detection

Detects Pterodactyl game server management panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pterodactyl game server management panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pterodactyl game server...

Avaya Aura System Manager Login - Panel Detect

Avaya Aura System Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Avaya Aura System Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avaya Aura System...

SEO King - Shopify App — Installer Detection

Shopify App is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Shopify App is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Laravel log file publicly accessible Detection

The log file of this Laravel web app might reveal details on the inner workings of the app, possibly even tokens, credentials or personal information. !/usr/bin/env python3 -- coding: utf-8 -- """The log file of this Laravel web app might reveal details on the inner workings of the app, possibly...

Apache Shenyu Gateway Management System - Detect

Detects a Apache Shenyu Gateway Management System, a Java native API Gateway for service proxy, protocol conversion and API governance. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Shenyu Gateway Management System, a Java native API Gateway for service proxy, protocol conve."""...

Cisco Unified Communications Self-Service User Portal - Detection

Detected the presence of the Cisco Unified Communications User Management Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the Cisco Unified Communications User Management Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BSDI FTP Service - Detect

BSDI FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BSDI FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'BSDI FTP Service - Detect',...

Hikvision Configuration File - Detect

Hikvision configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hikvision Configuration File - Detect...

DBeaver Database Connections - Detect

DBeaver database connections were detected. !/usr/bin/env python3 -- coding: utf-8 -- """DBeaver database connections were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DBeaver Database Connections -...

Tautulli Panel - Unauthenticated Access Detection

Detects Tautulli Panel - Unauthenticated Access. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Tautulli Panel - Unauthenticated Access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tautulli Panel -...

Neo4j Neodash - Detect

Detects a Neo4j Neodash web application, a Dashboard Builder for Neo4j. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Neo4j Neodash web application, a Dashboard Builder for Neo4j.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Booked < 2.2.6 - Broken Authentication Detection

The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute...

Easy FancyBox - Full Path Disclosure Detection

Easy FancyBox WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Easy FancyBox WordPress plug...

UVDesk Installation Wizard Detection

UVDesk is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """UVDesk is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AWS bucket with Object listing Detection

Object listing is enabled in AWS bucket. !/usr/bin/env python3 -- coding: utf-8 -- """Object listing is enabled in AWS bucket.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS bucket with Object listing Detection'...

LibreChat Login Panel - Detection

Detected LibreChat login panel. LibreChat is an open-source, self-hosted AI chat interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detected LibreChat login panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...