Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting Detection

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

Slims CMS - Detect

Detects Senayan Library Management System SLiMS CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Senayan Library Management System SLiMS CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Slims CMS - Detect...

OpenNMS Web Console Login Panel - Detect

OpenNMS Web Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenNMS Web Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenNMS Web Console Login Panel...

Kyocera Printer Panel - Detect

Kyocera printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kyocera Printer Panel - Detect', 'description':...

PHP-CS-Fixer Cache - File Disclosure Detection

PHP CS fixer cache internal file is disclosed. !/usr/bin/env python3 -- coding: utf-8 -- """PHP CS fixer cache internal file is disclosed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PHP-CS-Fixer Cache - File...

pCOWeb Panel - Detect

Detects pCOWeb Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects pCOWeb Panel - Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'pCOWeb Panel - Detect', 'description': 'Detects...

XWiki Platform - SQL Injection Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 through 17.2.2, it's possible for anyone to inject SQL using the parameter sort of the getdeleteddocuments.vm. It's injected as is as an...

Ivanti Endpoint Manager (EPM) - Detect

An Ivanti Endpoint Manager was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Ivanti Endpoint Manager was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info = 'name...

Schneider TAC Vista - Login Panel Detection

Schneider TAC Vista building automation panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Schneider TAC Vista building automation panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Polycom Admin Panel - Detect

Polycom admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Polycom admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Polycom Admin Panel - Detect', 'description': 'Polycom...

Default Parallels Plesk Panel Page Detection

Detects Default Parallels Plesk Panel Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Default Parallels Plesk Panel Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Default Parallels Plesk Panel Page...

LuxTrust COSI - Detect

LuxTrust COSI was detected. !/usr/bin/env python3 -- coding: utf-8 -- """LuxTrust COSI was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LuxTrust COSI - Detect', 'description': 'LuxTrust COSI was...

Malwared (Build Your Own Botnet) - Detect

Detects the presence of the Malwared - Build Your Own Botnet tool on the target system. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Malwared - Build Your Own Botnet tool on the target system.""" from kittysploit import from lib.protocols.http.httpclient import...

Senayan Library Management System v9.5.2 (Bulian) - Cross-Site Scripting Detection

SLiMS 9.5.2 Bulian vulnerable to Cross-Site Scripting in index.php. When injected, website will execute the payload repeatedly !/usr/bin/env python3 -- coding: utf-8 -- """SLiMS 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

CentOs-WebPanel Test Page Detection

Detects CentOs-WebPanel Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CentOs-WebPanel Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CentOs-WebPanel Test Page Detection', 'description':...

Server Monitor Installer Detection

Server Monitor is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Server Monitor is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

WordPress Pie Register < 3.7.2.4 - Open Redirect Detection

WordPress Pie Register 3.7.2.4 is susceptible to an open redirect vulnerability because the plugin passes unvalidated user input to the wpredirect function. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pie Register 3.""" import re from kittysploit import from lib.protocols.http.httpclie...

Umbraco Login Panel - Detect

Umbraco login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Umbraco login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Umbraco Login Panel - Detect', 'description': 'Umbraco...

Jabber XMPP Protocol - Detect

Jabber XMPP protocol was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jabber XMPP protocol was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Jabber XMPP Protocol -...

MyBB - Full Path Disclosure Detection

Detected MyBB forum software exposed the server's full filesystem path through PHP fatal errors when files that implemented interfaces were accessed without dependencies. !/usr/bin/env python3 -- coding: utf-8 -- """Detected MyBB forum software exposed the server's full filesystem path through PH...

Comtrend ADSL - Remote Code Execution Detection

Comtrend ADSL CT-5367 C01R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Comtre...

SolarView Compact Panel - Detect

SolarView Compact panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SolarView Compact panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SolarView Compact Panel - Detect', 'description...

TurboCRM - Cross-Site Scripting Detection

TurboCRM contains a cross-site scripting vulnerability which allows a remote attacker to inject arbitrary JavaScript into the response returned by the application. !/usr/bin/env python3 -- coding: utf-8 -- """TurboCRM contains a cross-site scripting vulnerability which allows a remote attacker to...

NPM Anonymous CLI Metrics Exposure Detection

Detects NPM Anonymous CLI Metrics Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects NPM Anonymous CLI Metrics Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NPM Anonymous CLI Metrics Exposure...

Ecology - Information Exposure Detection

The "ecology" component exposes a file that contains sensitive database credentials dbuser/dbpass. !/usr/bin/env python3 -- coding: utf-8 -- """The "ecology" component exposes a file that contains sensitive database credentials dbuser/dbpass.""" from kittysploit import from...

Oracle Siebel Loyalty 8.1 - Cross-Site Scripting Detection

A vulnerability in Oracle Siebel Loyalty allows remote unauthenticated attackers to inject arbitrary Javascript code into the responses returned by the '/loyaltyenu/start.swe/' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Oracle Siebel Loyalty allows remote...

OpenShift OAuth Proxy - Panel Detect

Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login page content. Checks both the default port and port 9001. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenShift OAuth Proxy login endpoints via oauthproxycsrf or oauthproxy cookie and login pa...

DokuWiki - Cross-Site Scripting Detection

DokuWiki through 2017-02-19b contains a cross-site scripting vulnerability in the DATEAT parameter to doku.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

NocoDB < 0.258.0 - Reflected XSS in Password Reset Detection

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. !/usr/bin/env...

Kiwi TCMS Login Panel - Detect

Kiwi TCMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kiwi TCMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kiwi TCMS Login Panel - Detect', 'description': 'Ki...

ExpressionEngine Exception - Page Detection

Detects ExpressionEngine Exception - Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ExpressionEngine Exception - Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ExpressionEngine Exception - Page...

PowerChute Network Shutdown Panel - Detect

Detects PowerChute Network Shutdown Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects PowerChute Network Shutdown Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PowerChute Network...

Passbolt Login Panel Detection

Passbolt login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Passbolt login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Passbolt Login Panel Detection', 'description':...

FusionAuth Admin Panel - Detect

Detects FusionAuth Admin Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FusionAuth Admin Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FusionAuth Admin Panel - Detect',...

GeoWebServer Detector Panel - Detect

GeoWebServer Detector panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GeoWebServer Detector panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GeoWebServer Detector Panel - Detect',...

AVTECH Room Alert Login Panel - Detect

AVTECH Room Alert login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AVTECH Room Alert login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AVTECH Room Alert Login Panel -...

Zen Cart Installer Detection

Zen Cart is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Zen Cart is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Shell In A Box - Detect

Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal emulator !/usr/bin/env python3 -- coding: utf-8 -- """Shell In A Box implements a web server that can export arbitrary command line tools to a web based terminal em.""" from kittysploit...

Asanhamayesh CMS 3.4.6 - Local File Inclusion Detection

Asanhamayesh CMS 3.4.6 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Asanhamayesh CMS 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Asanhamayesh CMS 3.4.6 - Local...

Liferay /api/jsonws - API Exposed Detection

Liferay /api/jsonws - API is Exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay /api/jsonws - API is Exposed.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Liferay /api/jsonws - API Exposed...

Zzcms `register_nodb.php` - Cross Site Scripting Detection

Identified a reflected Cross-Site Scripting XSS vulnerability in registernodb.php of ZZCMS, which allowed injection of malicious scripts via user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """Identified a reflected Cross-Site Scripting XSS vulnerability in registernodb.""" from...

Shoppable Service Auth Token Detection

Detects Shoppable Service Auth Token. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Shoppable Service Auth Token.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Shoppable Service Auth Token Detection',...

Unauthenticated Lansweeper Instance Detection

Lansweeper Instance is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Lansweeper Instance is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unauthenticated Lansweeper Instance Detection',...

AIX WebSM - Detect

Detects IBM AIX Web-based System Manager services. !/usr/bin/env python3 -- coding: utf-8 -- """Detects IBM AIX Web-based System Manager services.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info =...

Grav CMS Detect

Detects Grav CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Grav CMS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Grav CMS Detect', 'description': 'Detects Grav CMS', 'author': 'KittySploit Team',...

Gradle Enterprise Build Cache Node Login Panel - Detect

Gradle Enterprise Build Cache Node login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gradle Enterprise Build Cache Node login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Apache Solr Admin Panel - Detect

Apache Solr admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Solr admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache Solr Admin Panel - Detect', 'description...

Royal Event Management System Admin Panel - Detect

Royal Event Management System admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Royal Event Management System admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Royal Event...

Cockpit - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.""" from kittysploit import from lib.protocols.http.httpclient import...

WAVLINK WN535 G3 - Improper Access Control Detection

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to improper access control. A vulnerability in /cgi-bin/ExportAllSettings.sh allows an attacker to execute arbitrary code via a crafted POST request and thereby possibly obtain sensitive information, modify data, and/or execute unauthorized...