Forescout CounterACT 6.3.4.1 - Open Redirect Detection

Open redirect vulnerability in assets/login on the Forescout CounterACT NAC device before 7.0 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the 'a' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Open redirect vulnerability in...

WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in the MF Gig Calendar plugin 0.9.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the calendar page. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in the MF Gig Calendar...

Gradio - Open Redirect Detection

An open redirect vulnerability in Gradio allows attackers to craft malicious URLs that redirect users to external, potentially harmful sites without proper validation. !/usr/bin/env python3 -- coding: utf-8 -- """An open redirect vulnerability in Gradio allows attackers to craft malicious URLs th...

Odoo <= 8.0-20160726 & 9.0 - Open Redirect Detection

An Open Redirect vulnerability in Odoo versions = 8.0-20160726 and 9.0. This issue allows an attacker to redirect users to untrusted sites via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """An Open Redirect vulnerability in Odoo versions = 8.""" import re from kittysploit import from...

Financial Transaction Manager Login Panel - Detect

Financial Transaction Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Financial Transaction Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Financial...

Primetek Primefaces 5.x - Remote Code Execution Detection

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Primetek Primefaces 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Joomla! Percha Categories Tree 0.6 - Local File Inclusion Detection

A directory traversal vulnerability in the Percha Fields Attach comperchafieldsattach component 1.x for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding:...

WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting Detection

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...

Schneider Electric Pelco VideoXpert Enterprise 2.0 - Path Traversal Detection

Schneider Electric Pelco VideoXpert Enterprise versions 2.0 and prior contain a directory traversal caused by insufficient input validation, letting unauthorized persons view web server files, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Schneider Electric Pelc...

DokuWiki - Cross-Site Scripting Detection

DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATEAT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

FileGator Panel - Detect

Detects FileGator Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FileGator Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FileGator Panel - Detect', 'description': 'Detects...

Exposed Spring Data REST Application-Level Profile Semantics (ALPS) Detection

Exposed Spring Data profile semantics is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Spring Data profile semantics is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Exposed Spring Data RES...

EOS HTTP Browser Detection

Detects EOS HTTP Browser. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EOS HTTP Browser.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EOS HTTP Browser Detection', 'description': 'Detects EOS HTTP Browser.'...

Extreme NetConfig UI Panel - Detect

Extreme NetConfig UI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Extreme NetConfig UI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Extreme NetConfig UI Panel - Detect',...

Flutter Web Application - Detect

Detect flutter web apps looking for flutterbootstrap.js,main.dart.js and flutterserviceworker.js files. !/usr/bin/env python3 -- coding: utf-8 -- """Detect flutter web apps looking for flutterbootstrap.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zimbra - Cross-Site Scripting via ICS Files Detection

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

Ghost CMS <=4.32 - Cross-Site Scripting Detection

Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code. !/usr/bin/env python3 -- coding: utf-8 -- """Ghost CMS 4."""...

librechat - Config Exposure Detection

Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially exposing internal configuration details. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the /api/config endpoint of the LibreChat web application was publicly accessible, potentially...

Dynamics Container Host - Detect

Dynamics Container Host is detected in this template. !/usr/bin/env python3 -- coding: utf-8 -- """Dynamics Container Host is detected in this template.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dynamics...

Apache httpd Config File - Detect

Apache httpd configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apache httpd configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache httpd Conf...

Telnet Detection

Telnet is a network protocol used to virtually access a computer and to provide a two-way, collaborative and text-based communication channel between two machines. !/usr/bin/env python3 -- coding: utf-8 -- """Telnet is a network protocol used to virtually access a computer and to provide a two-wa...

SIP OPTIONS Detection

Sends a SIP OPTIONS request over TCP then UDP fallback to fingerprint PBX / VoIP endpoints on port 5060. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SIP services via OPTIONS probe TCP then UDP.""" from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient from...

Issabel PBX 4.0.0-6 - Directory Listing Detection

An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory !/usr/bin/env python3 -- coding: utf-8 -- """An issue in issabel-pbx v.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

Apache mod_userdir CRLF injection Detection

Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir. !/usr/bin/env python3 -- coding: utf-8 -- """Apache CRLF injection allowing HTTP response splitting attacks on sites using moduserdir.""" import re from kittysploit import from lib.protocols.http.httpclient...

GitLab public signup Detection

Detects GitLab public signup. !/usr/bin/env python3 -- coding: utf-8 -- """Detects GitLab public signup.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GitLab public signup Detection', 'description': 'Detects GitLab...

EspoCRM - Detect

EspoCRM panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EspoCRM panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EspoCRM - Detect', 'description': 'EspoCRM panel was detected.',...

FlatnuX CMS - Directory Traversal Detection

A path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action. !/usr/bin/env python3 -- coding: utf-8 -- """A path traversal vulnerability in controlcenter.""...

Drone - Configuration Detection

Drone configuration was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Drone configuration was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Drone - Configuration Detection', 'description':...

SearXNG - Detect

A SearXNG search engine was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A SearXNG search engine was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SearXNG - Detect', 'description': 'A SearXNG...

DocuWare - Detect

DocuWare panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """DocuWare panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DocuWare - Detect', 'description': 'DocuWare panel was detected.'...

Joomla! Component iNetLanka Multiple Map 1.0 - Local File Inclusion Detection

A directory traversal vulnerability in the iNetLanka Multiple Map commultimap component 1.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in th...

ExpressionEngine Exception - Page Detection

Detects ExpressionEngine Exception - Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ExpressionEngine Exception - Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ExpressionEngine Exception - Page...

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting Detection

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple cross-site scripting vulnerabiliti...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

DotNetNuke 9.2 - 9.2.1 - Weak Encryption & Cookie Deserialization Detection

DNN DotNetNuke versions 9.2 through 9.2.1 use a weak encryption algorithm to protect input parameters. This cryptographic weakness enables attackers to craft malicious DNNPersonalization cookies that can be deserialized, leading to remote code execution. !/usr/bin/env python3 -- coding: utf-8 --...

AfterLogic Aurora and WebMail Pro < 7.7.9 - Information Disclosure Detection

AfterLogic Aurora and WebMail Pro products with 7.7.9 and all lower versions are affected by this vulnerability, simply sending an HTTP GET request to WebDAV EndPoint with built-in “caldavpublicuser@localhost” and it’s the predefined password “caldavpublicuser” allows the attacker to read all fil...

N-central - Authentication Bypass Detection

N-central 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. !/usr/bin/env python3 -- coding: utf-8 -- """N-central 2025.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

DotNetNuke 07.04.00 - Administration Authentication Bypass Detection

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx. !/usr/bin/env python3 -- coding: utf-8 -- """The installation wizard in DotNetNuke DNN before 7.""" from...

Dockerfile - Detect

Dockerfile was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dockerfile was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dockerfile - Detect', 'description': 'Dockerfile was detected.'...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

Nginx HTTP Server Amazon Linux Detection

Detects Nginx HTTP Server Amazon Linux. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx HTTP Server Amazon Linux.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx HTTP Server Amazon Linux Detection',...

DOMOS 5.5 - Local File Inclusion Detection

SECUDOS DOMOS before 5.6 allows local file inclusion via the log module. !/usr/bin/env python3 -- coding: utf-8 -- """SECUDOS DOMOS before 5.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DOMOS 5.5 - Loca...

GL.iNET SSID Key Disclosure Detection

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered on GL.""" from kittysploit import from lib.protocols.http.httpclient import...

Booked < 2.2.6 - Broken Authentication Detection

The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute...

Polyfill.io - Backdoor Detection

The polyfill.io CDN was suspected to serve malware. Note: it's not exploitable anymore !/usr/bin/env python3 -- coding: utf-8 -- """The polyfill.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Polyfill.io ...

Seagate NAS OS 4.3.15.1 - Server Information Disclosure Detection

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.getinfos. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS version 4.""" from...

Moodle Installation Exposure Detection

Moodle is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Moodle is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FortiRecorder Panel - Detect

FortiRecorder Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """FortiRecorder Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FortiRecorder Panel - Detect', 'description':...

DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...