Netdisco - Unauth Access Detection

Detects an unauth dashboard access of Netdisco. !/usr/bin/env python3 -- coding: utf-8 -- """Detects an unauth dashboard access of Netdisco.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Netdisco - Unauth Access...

Go.mod Disclosure Detection

go.mod internal file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """go.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Go.mod Disclosure Detection', 'description': 'go.mod internal file is exposed.',...

WebPageTest Login Panel - Detect

WebPageTest login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WebPageTest login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebPageTest Login Panel - Detect', 'description...

CentreStack Login Panel - Detect

Gladinet CentreStack login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gladinet CentreStack login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CentreStack Login Panel -...

ShardingSphere ElasticJob UI Panel Detection

An ShardingSphere ElasticJob UI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An ShardingSphere ElasticJob UI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ShardingSphere...

Joget Panel - Detect

Joget panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Joget panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Joget Panel - Detect', 'description': 'Joget panel was detected.',...

Qlik Sense Server Panel - Detect

Qlik Sense Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qlik Sense Server panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qlik Sense Server Panel - Detect', 'description...

SphinxOnline Panel - Detect

SphinxOnline Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SphinxOnline Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SphinxOnline Panel - Detect', 'description':...

Mage AI - Insecure Default Authentication Setup Detection

A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default initialization of resource. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability i...

EMQX Login Panel - Detect

EMQX login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EMQX login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EMQX Login Panel - Detect', 'description': 'EMQX login panel...

EasyCVR <=2.1.2 - Information Disclosure Detection

A vulnerability has been found in Anhui Xufan Information Technology EasyCVR up to 2.7.0 and classified as problematic. This vulnerability affects unknown code of the file /api/v1/getbaseconfig. The manipulation leads to information disclosure. The attack can be initiated remotely. The exploit ha...

Triofox - Improper Access Control Detection

The Gladinet Triofox solution before 12.91.1126.65588 and CentreStack before 12.10.595.65696 allow unauthenticated access to the /management/admindatabase.aspx endpoint, exposing sensitive database management functionality to anyone with network access. An unauthenticated attacker can remotely...

Deprecated Feature-Policy Header - Detection

Detected the presence of the deprecated Feature-Policy HTTP response header. The Feature-Policy header has been deprecated and replaced by the Permissions-Policy header. While Feature-Policy is still supported in some browsers for backward compatibility, it is recommended to migrate to...

Detect DNS over HTTPS

With DNS over HTTPS DoH, DNS queries and responses are encrypted and sent via the HTTP or HTTP/2 protocols. DoH ensures that attackers cannot forge or alter DNS traffic. DoH uses port 443, which is the standard HTTPS traffic port, to wrap the DNS query in an HTTPS request. DNS queries and respons...

Detect Graylog REST API

Detects Detect Graylog REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Detect Graylog REST API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Graylog REST API', 'description': 'Detects Detect...

Pichome 2.1.0 - Arbitrary File Read Detection

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed t...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA...

Overseerr Panel - Detect

Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem. !/usr/bin/env python3 -- coding: utf-8 -- """Overseerr is a request management and media discovery tool built to work with your existing Plex ecosystem.""" from kittysploit import from...

OpenCode Web - Unauthenticated Access Detection

Unauthenticated network access to the OpenCode web interface was detected. When the OpenCode web server is started without setting the OPENCODESERVERPASSWORD environment variable, the server is completely unsecured. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated network access to th...

Huawei Router - Authentication Bypass Detection

Huawei Routers are vulnerable to authentication bypass because the default password of this router is the last 8 characters of the device's serial number which exist on the back of the device. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Routers are vulnerable to authentication bypass...

LearnPress < 4.3.2 - Broken Access Control Detection

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic function in all versions up to, and including, 4.3.1. This makes it possible for unauthenticated attackers to view the plugin's orders...

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure Detection

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. !/usr/bin/env python3 -- coding: utf-8 -- """WordPres...

Acexy Wireless-N WiFi Repeater REV 1.0 - Repeater Password Disclosure Detection

Acexy Wireless-N WiFi Repeater REV 1.0 is vulnerable to password disclosure because the password.html page of the web management interface contains the administrator account password in plaintext. !/usr/bin/env python3 -- coding: utf-8 -- """Acexy Wireless-N WiFi Repeater REV 1.""" from kittysplo...

Toshiba TopAccess Panel - Detect

Detects Toshiba TopAccess Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Toshiba TopAccess Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Toshiba TopAccess Panel - Detect',...

DocuWare - Detect

DocuWare panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """DocuWare panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DocuWare - Detect', 'description': 'DocuWare panel was detected.'...

QuestDB Console - Detect

QuestDB console was detected. !/usr/bin/env python3 -- coding: utf-8 -- """QuestDB console was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'QuestDB Console - Detect', 'description': 'QuestDB console was...

UFIDA NC Portal - Arbitrary File Read Detection

There is any file reading in the getFileLocal interface of UFIDA Mobile System Management. !/usr/bin/env python3 -- coding: utf-8 -- """There is any file reading in the getFileLocal interface of UFIDA Mobile System Management.""" from kittysploit import from lib.protocols.http.httpclient import...

Mastodon - Open Redirect Detection

Mastodon version 4.5.8, 4.4.15, 4.3.21 is vulnerable to unauthenticated Open Redirect vulnerability CWE-601 exists in the /web/ route due to improper handling of URL-encoded path segments. !/usr/bin/env python3 -- coding: utf-8 -- """Mastodon version 4.""" import re from kittysploit import from...

HCM Cloud - Arbitrary File Read Detection

HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """HCM-Cloud professional human resources platform in the cloud download Arbitrary file read vulnerability.""" import re from kittysploit import from...

Seagate NAS Login - Detect

Seagate NAS - SEAGATE Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS - SEAGATE Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seagate NAS Login - Detect',...

Free5gc 3.2.1 - Information Disclosure Detection

Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Free5gc 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

WordPress Gallery <2.0.0 - Cross-Site Scripting Detection

WordPress Gallery plugin before 2.0.0 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, available to both unauthenticated and authenticated users. !/usr/bin/env python3 -- coding: utf-8...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting Detection

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Icewarp Icearp v10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Atarim < 4.2.2 - Sensitive Information Exposure Detection

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -...

Telaen => v1.3.1 - Open Redirect Detection

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """Open Redirection Vulnerability in the redir.""" import re from kittysploit import from...

twitter-server Cross-Site Scripting Detection

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. !/usr/bin/env python3 -- coding: utf-8 -- """twitter-serve...

Microsoft SharePoint - Master Page Disclosure Detection

Detected exposed SharePoint Master Page endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint Master Page endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft SharePoint ...

ICT Protege WX Login Panel - Detect

Detects ICT Protege WX Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ICT Protege WX Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ICT Protege WX Login Panel -...

Supertokens Login Panel - Detect

A Supertokens login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Supertokens login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Supertokens Login Panel - Detect',...

Dotclear Admin Login Panel - Detect

Dotclear admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dotclear admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dotclear Admin Login Panel - Detect',...

GlobalSCAPE Secure FTP Service - Detect

GlobalSCAPE Secure FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GlobalSCAPE Secure FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name':...

HOOBS Panel - Detect

HOOBS is a home automation platform that bridges HomeKit and non-HomeKit devices. !/usr/bin/env python3 -- coding: utf-8 -- """HOOBS is a home automation platform that bridges HomeKit and non-HomeKit devices.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Ruby on Rails - CRLF Injection and Cross-Site Scripting Detection

Ruby on Rails 6.0.0-6.0.3.1 contains a CRLF issue which allows JavaScript to be injected into the response, resulting in cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Plugin SG Optimizer - Full Path Disclosure Detection

WordPress Plugin SG Optimizer Plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin SG Optimizer Plugin files are publicly...

YzmCMS Login Panel - Detect

YzmCMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """YzmCMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YzmCMS Login Panel - Detect', 'description': 'YzmCMS logi...

Fortinet FortiAnalyzer - Login Panel Detection

Fortinet FortiAnalyzer is a centralised log management and analytics platform for Fortinet security devices. The web management console is commonly internet-exposed on ports 443, 10443, 9443, or 4443. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiAnalyzer is a centralised log...

Forcepoint Appliance Detection

Detects Forcepoint Appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Forcepoint Appliance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Forcepoint Appliance Detection', 'description': 'Detects...

WordPress NativeChurch Theme - Local File Inclusion Detection

WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.php file. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress NativeChurch Theme is vulnerable to local file inclusion in the download.""" from kittysploit import from lib.protocols.http.httpclient import...

Pterodactyl game server - Panel Detection

Detects Pterodactyl game server management panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pterodactyl game server management panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pterodactyl game server...

Avaya Aura System Manager Login - Panel Detect

Avaya Aura System Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Avaya Aura System Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avaya Aura System...