SEO King - Shopify App — Installer Detection

Shopify App is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Shopify App is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Laravel log file publicly accessible Detection

The log file of this Laravel web app might reveal details on the inner workings of the app, possibly even tokens, credentials or personal information. !/usr/bin/env python3 -- coding: utf-8 -- """The log file of this Laravel web app might reveal details on the inner workings of the app, possibly...

Apache Shenyu Gateway Management System - Detect

Detects a Apache Shenyu Gateway Management System, a Java native API Gateway for service proxy, protocol conversion and API governance. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Shenyu Gateway Management System, a Java native API Gateway for service proxy, protocol conve."""...

Cisco Unified Communications Self-Service User Portal - Detection

Detected the presence of the Cisco Unified Communications User Management Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the presence of the Cisco Unified Communications User Management Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

BSDI FTP Service - Detect

BSDI FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BSDI FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'BSDI FTP Service - Detect',...

Hikvision Configuration File - Detect

Hikvision configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hikvision configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hikvision Configuration File - Detect...

DBeaver Database Connections - Detect

DBeaver database connections were detected. !/usr/bin/env python3 -- coding: utf-8 -- """DBeaver database connections were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DBeaver Database Connections -...

Tautulli Panel - Unauthenticated Access Detection

Detects Tautulli Panel - Unauthenticated Access. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Tautulli Panel - Unauthenticated Access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tautulli Panel -...

Neo4j Neodash - Detect

Detects a Neo4j Neodash web application, a Dashboard Builder for Neo4j. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Neo4j Neodash web application, a Dashboard Builder for Neo4j.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Easy FancyBox - Full Path Disclosure Detection

Easy FancyBox WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Easy FancyBox WordPress plug...

UVDesk Installation Wizard Detection

UVDesk is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """UVDesk is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

AWS bucket with Object listing Detection

Object listing is enabled in AWS bucket. !/usr/bin/env python3 -- coding: utf-8 -- """Object listing is enabled in AWS bucket.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS bucket with Object listing Detection'...

LibreChat Login Panel - Detection

Detected LibreChat login panel. LibreChat is an open-source, self-hosted AI chat interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detected LibreChat login panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Raygun RUM - Detect

Detects ACTIVE Raygun Raygun4JS Error Tracking & Real User Monitoring implementations. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ACTIVE Raygun Raygun4JS Error Tracking & Real User Monitoring implementations.""" import re from kittysploit import from lib.protocols.http.httpclient import...

QuickCMS Installation Wizard Detection

PMM is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """PMM is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Mitel NuPoint Unified Messaging Panel - Detect

Mitel NuPoint Unified Messaging login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Mitel NuPoint Unified Messaging login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Mitel...

Dash Panel Detect

Detects Dash Panel Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dash Panel Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dash Panel Detect', 'description': 'Detects Dash Panel Detect.',...

Samsung MagicINFO Panel - Detect

Samsung MagicINFO panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung MagicINFO panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Samsung MagicINFO Panel - Detect',...

SonicWall Network Security Login - Detect

SonicWall Network Security Login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall Network Security Login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SonicWall Network...

LM Studio Panel - Detect

LM Studio is a desktop application for discovering, downloading, and running local LLMs !/usr/bin/env python3 -- coding: utf-8 -- """LM Studio is a desktop application for discovering, downloading, and running local LLMs.""" from kittysploit import from lib.protocols.http.httpclient import...

OpenHAP Detection

Detects OpenHAP Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenHAP Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenHAP Detection', 'description': 'Detects OpenHAP Detection.',...

Aethra Telecommunications Login - Panel Detection

Aethra Telecommunication login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Aethra Telecommunication login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Aethra...

Reality Estate Multipurpose WP-Theme < 2.5.3 - Cross-Site Scripting Detection

Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected XSS was discovered in the 'Reality | Estate Multipurpose WordPress Theme'.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

SolarView Compact 6.00 - Cross-Site Scripting Detection

SolarView Compact 6.00 contains a cross-site scripting vulnerability via fname at /SolarImage.php. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

PostgreSQL Cluster - Configuration Detection

PostgreSQL Cluster Configuration Page was detected and appeared to be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """PostgreSQL Cluster Configuration Page was detected and appeared to be accessible without authentication.""" from kittysploit import from...

Statamic - Detect

Statamic is the flat-first, Laravel + Git powered CMS designed for building beautiful, easy to manage websites. !/usr/bin/env python3 -- coding: utf-8 -- """Statamic is the flat-first, Laravel + Git powered CMS designed for building beautiful, easy to manage websites.""" import re from kittysploi...

Oracle Application Server Containers Detection

Detects Oracle Application Server Containers. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle Application Server Containers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle Application Server...

Amcrest Login Detection

An Amcrest LDAP user login was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Amcrest LDAP user login was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Amcrest Login Detection',...

PocketBase Panel - Detect

PocketBase Login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """PocketBase Login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PocketBase Panel - Detect', 'description':...

Icecast Config - File Disclosure Detection

Icecast Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Icecast Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Icecast Config - File Disclosure Detection', 'description':...

Azure Function App - Default Page Detection

Detects Azure Function App - Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Azure Function App - Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Azure Function App - Default Page...

Pair Drop Panel - Detect

Local file sharing in your browser. Inspired by Apple's AirDrop. Fork of Snapdrop. !/usr/bin/env python3 -- coding: utf-8 -- """Local file sharing in your browser.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pair...

Anchor CMS 0.12.3 - Error Log Exposure Detection

Anchor CMS 0.12.3 is susceptible to an error log exposure vulnerability due to an issue in config/error.php. The error log is exposed at an errors.log URI, and contains MySQL credentials if a MySQL error such as "Too many connections" has occurred. !/usr/bin/env python3 -- coding: utf-8 --...

Pyramid Debug Toolbar Detection

Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application. !/usr/bin/env python3 -- coding: utf-8 -- """Pyramid Debug Toolbar provides a debug toolbar useful while you are developing your Pyramid application.""" from kittysploit import from...

BentoML v1.3.9 - Open Redirect Detection

An open redirect vulnerability exists in BentoML v1.3.9, where the file parameter in the /ui/gradioapi/file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. !/usr/bin/env python3 ...

WebShell4 Login Panel - Detect

WebShell4 login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WebShell4 login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebShell4 Login Panel - Detect', 'description':...

Axigen WebMail - Cross-Site Scripting Detection

Cross Site Scripting XSS vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions...

Nortek Linear eMerge Panel - Detect

Nortek Linear eMerge panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nortek Linear eMerge panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nortek Linear eMerge Panel -...

Spring Boot Information Panel - Detect

Spring Boot information panel displaying app name, version information, and other values was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot information panel displaying app name, version information, and other values was detected.""" from kittysploit import from...

phpShowtime 2.0 - Directory Traversal Detection

A directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. dot dot in the r parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in phpShowtime 2.""" import re from...

WordPress Download Manager <2.9.94 - Cross-Site Scripting Detection

WordPress Download Manager plugin before 2.9.94 contains a cross-site scripting vulnerability via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Download Manager plugin before 2.""" from...

CaseAware a360inc - Cross-Site Scripting Detection

a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in 2017 !/usr/bin/env python3 -- coding: utf-8 -- """a360inc CaseAware contains a reflected cross-site scripting...

EVlink City < R8 V3.4.0.1 - Authentication Bypass Detection

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

Zimbra Collaboration (ZCS) - Cross Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the /public/launchNewWindow.jsp component of Zimbra Collaboration aka ZCS 9.0 allows unauthenticated attackers to execute arbitrary web script or HTML via request parameters. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site...

Newspaper Theme 6.4–6.7.1 - Privilege Escalation Detection

Newspaper Theme versions 6.4 to 6.7.1 for WordPress lacked proper options access control through tdajaxupdatepanel, which led to a Privilege Escalation vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Newspaper Theme versions 6.""" from kittysploit import from...

WordPress Integrator 1.32 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting...

WAVLINK WN530HG4 - Improper Access Control Detection

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. It contains a hardcoded encryption/decryption key for its configuration files at /etcro/lighttpd/www/cgi-bin/ExportAllSettings.sh. An attacker can possibly obtain sensitive information, modify data, and/or execute...

SureTriggers <= 1.0.78 - Authentication Bypass

Unauthenticated admin user creation via sure-triggers automation action when secretkey empty. !/usr/bin/env python3 -- coding: utf-8 -- """SureTriggers = 1.0.78 - Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Duplicate Page - Full Path Disclosure Detection

WordPress Plugin Duplicate Page files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Duplicate Page files are publicly accessible withou...

HD-Network Realtime Monitoring System 2.0 - Local File Inclusion Detection

Instances of HD-Network Realtime Monitoring System version 2.0 are vulnerable to a Local File Inclusion vulnerability which allows remote unauthenticated attackers to view confidential information. !/usr/bin/env python3 -- coding: utf-8 -- """Instances of HD-Network Realtime Monitoring System...