TOTOLINK/Realtek Routers - Information Disclosure Detection

A certain router administration interface using Realtek APMIB e.g., on TOTOLINK models allows unauthenticated remote attackers to disclose the entire router configuration, including sensitive credentials, via accessing the "config.dat" file. Affected devices include TOTOLINK A3002RU through 2.0.0...

PowerJob <=4.3.2 - Unauthenticated Access Detection

PowerJob V4.3.1 is vulnerable to Insecure Permissions. via the list job interface. !/usr/bin/env python3 -- coding: utf-8 -- """PowerJob V4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PowerJob =4.3.2 -...

Frigate < 0.13.0 Beta 3 - Cross-Site Scripting Detection

Frigate is an open source network video recorder. Before version 0.13.0 Beta 3, there is a reflected cross-site scripting vulnerability in any API endpoints reliant on the / base path as values provided for the path are not sanitized. Exploiting this vulnerability requires the attacker to both kn...

WordPress Download Manager <= 3.2.59 - Reflected XSS Detection

W3 Eden, Inc. Download Manager plugin = 3.2.59 contains a reflected cross-site scripting caused by insufficient input sanitization, letting attackers execute scripts in the context of the victim's browser, exploit requires attacker to craft a malicious link. !/usr/bin/env python3 -- coding: utf-8...

Icinga Web 2 - Arbitrary File Disclosure Detection

Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. !/usr/bin/env python3 --...

Cuppa CMS v1.0 - Local File Inclusion Detection

CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertConfigField.php. !/usr/bin/env python3 -- coding: utf-8 -- """CuppaCMS v1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

XWiki < 14.10.5 - Cross-Site Scripting Detection

XWiki Platform is vulnerable to reflected XSS via the previewactions template. An attacker can inject JavaScript through the xcontinue parameter. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is vulnerable to reflected XSS via the previewactions template.""" from kittysploit import...

Joomla! Component iNetLanka Multiple root 1.0 - Local File Inclusion Detection

A directory traversal vulnerability in the iNetLanka Multiple root commultiroot component 1.0 and 1.1 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal...

MotionEye Config Info Disclosure Detection

MotionEye v0.42.1 and below allows attackers to access sensitive information via a GET request to /config/list. To exploit this vulnerability, a regular user password must be unconfigured. !/usr/bin/env python3 -- coding: utf-8 -- """MotionEye v0.""" from kittysploit import from...

Amatera Stealer C2 Panel - Detect

Amatera Stealer C2 Login Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Amatera Stealer C2 Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Amatera Stealer C2 Panel -...

u5cms v8.3.5 - Open Redirect Detection

u5cms version 8.3.5 contains a URL redirection vulnerability that can cause a user's browser to be redirected to another site via /loginsave.php. !/usr/bin/env python3 -- coding: utf-8 -- """u5cms version 8.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ThinVNC - Authentication Bypass Detection

ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via a specific command, potentially leading to unauthorized access and code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinVNC version 1.""" from kittysploit import from...

Blazor Boot File Disclosure Detection

Exposed Blazor Boot a web framework developed by Microsoft config file. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Blazor Boot a web framework developed by Microsoft config file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

vBulletin SQL Injection Detection

vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control that permits SQL injection attacks. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin before 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

IceWarp Webmail Server v10.2.1 - Cross Site Scripting Detection

Icewarp Icearp v10.2.1 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Icewarp Icearp v10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Free5gc 3.2.1 - Information Disclosure Detection

Free5gc 3.2.1 is susceptible to information disclosure. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Free5gc 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

IceWarp 11.4.6.0 - Cross-Site Scripting Detection

IceWarp 11.4.6.0 was discovered to contain a cross-site scripting XSS vulnerability via the color parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp 11.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

FRPS Dashboard - Detect

FRPS Dashboard panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FRPS Dashboard panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FRPS Dashboard - Detect', 'description': 'FRPS...

Apache OFBiz - XML External Entity Injection Detection

In Apache OFBiz 16.11.01 to 16.11.04, the OFBiz HTTP engine org.apache.ofbiz.service.engine.HttpEngine.java handles requests for HTTP services via the /webtools/control/httpService endpoint. Both POST and GET requests to the httpService endpoint may contain three parameters: serviceName,...

CraftCMS < 4.4.15 - Unauthenticated Remote Code Execution Detection

Craft CMS is a platform for creating digital experiences. This is a high-impact, low-complexity attack vector leading to Remote Code Execution RCE. Users running Craft installations before 4.4.15 are encouraged to update to at least that version to mitigate the issue. This issue has been fixed in...

Microweber < 1.2.17 - Cross-Site Scripting Detection

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter.""" from kittysploit import from...

Oracle Peoplesoft - Unauthenticated File Read Detection

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft component- Portal. Supported versions that are affected are 8.59 and 8.60. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise...

Piano LED Visualizer 1.3 - Local File Inclusion Detection

Piano LED Visualizer 1.3 and prior are vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Piano LED Visualizer 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Piano LED...

ATutor < 2.2.1 - Cross Site Scripting Detection

ATutor 2.2.1 was discovered with a vulnerability, a reflected cross-site scripting XSS, in ATtutor 2.2.1 via token body parameter. !/usr/bin/env python3 -- coding: utf-8 -- """ATutor 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

3CX Phone System Web Client Management Console - Panel Detect

3CX Phone System Web Client Management Console panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """3CX Phone System Web Client Management Console panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

ListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation Detection

The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lpccaddonsactions function. This makes it possible for unauthenticated attacker...

Jenkins - Remote Code Execution Detection

Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins is susceptible to a remote code execution vulnerability due to accessible script functionality.""" from kittysploit import from...

Detect websites using AWS bucket storage

Detects Detect websites using AWS bucket storage. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Detect websites using AWS bucket storage.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect websites using A...

Modular DS - Broken Access Control

Modular Connector login endpoint issues wordpressloggedin cookie without auth. !/usr/bin/env python3 -- coding: utf-8 -- """Modular DS - Broken Access Control""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Atlassian Jira Seraph - Authentication Bypass Detection

Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also...

WAVLINK WN530HG4 - Improper Access Control Detection

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd and thereby possibly obtain sensitive information, modify data, and/or execute...

WordPress Ad Inserter <2.7.10 - Cross-Site Scripting Detection

WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the htmlelementselection parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ad Inserter plugin before 2.""" from kittysplo...

Homer Panel - Detect

A simple static homepage was discovered !/usr/bin/env python3 -- coding: utf-8 -- """A simple static homepage was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Homer Panel - Detect', 'description': 'A...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download Detection

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

SolarWinds Serv-U 15.3 - Directory Traversal Detection

SolarWinds Serv-U 15.3 is susceptible to local file inclusion, which may allow an attacker access to installation and server files and also make it possible to obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site...

WordPress Simple File List <3.2.8 - Local File Inclusion Detection

WordPress Simple File List before 3.2.8 is vulnerable to local file inclusion via the eeFile parameter in the /includes/ee-downloader.php due to missing controls which make it possible for unauthenticated attackers retrieve arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting Detection

L-Soft LISTSERV before 16.5-2018a contains a reflected cross-site scripting vulnerability via the /scripts/wa.exe OK parameter. !/usr/bin/env python3 -- coding: utf-8 -- """L-Soft LISTSERV before 16.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Nortek Linear eMerge E3-Series - Cross-Site Scripting Detection

There is a local session fixation vulnerability that, when chained with cross-site scripting, leads to account take over of admin or a lower privileged user. !/usr/bin/env python3 -- coding: utf-8 -- """There is a local session fixation vulnerability that, when chained with cross-site scripting,...

Revive Adserver <5.1.0 - Open Redirect Detection

Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...

JeecgBoot 3.5.0 - SQL Injection Detection

jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. !/usr/bin/env python3 -- coding: utf-8 -- """jeecg-boot 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

Budibase - Admin Installer Detection

Detected Budibase admin setup checklist endpoint was publicly accessible with no admin user created, allowing unauthenticated users to complete setup and gain full platform control. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Budibase admin setup checklist endpoint was publicly accessib...

NetScaler AAA Login Panel - Detect

NetScaler AAA login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """NetScaler AAA login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NetScaler AAA Login Panel - Detect',...

XWiki < 4.10.15 - Information Disclosure Detection

The Solr-based search suggestion provider that also duplicates as generic JavaScript API for search results in XWiki exposes the content of all documents of all wikis to anybody who has access to it, by default it is public. This exposes all information stored in the wiki but not some protected...

Ruby on Rails - CRLF Injection and Cross-Site Scripting Detection

Ruby on Rails 6.0.0-6.0.3.1 contains a CRLF issue which allows JavaScript to be injected into the response, resulting in cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Gryphon Tower - Cross-Site Scripting Detection

Gryphon Tower router web interface contains a reflected cross-site scripting vulnerability in the url parameter of the /cgi-bin/luci/siteaccess/ page. An attacker can exploit this issue by tricking a user into following a specially crafted link, granting the attacker JavaScript execution in the...

SecNet Login Panel - Detect

SecNet login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SecNet login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SecNet Login Panel - Detect', 'description': 'SecNet logi...

GCP/AWS Metadata Disclosure Detection

GCP/AWS Metadata is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """GCP/AWS Metadata is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GCP/AWS Metadata Disclosure Detection', 'description': 'GCP/AWS...

Tiny Java Web Server - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting...

Telaen => v1.3.1 - Open Redirect Detection

Open Redirection Vulnerability in the redir.php script in Telaen before 1.3.1 allows remote attackers to redirect victims to arbitrary websites via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """Open Redirection Vulnerability in the redir.""" import re from kittysploit import from...

Joomla! Component Graphics 1.0.6 - Local File Inclusion Detection

A directory traversal vulnerability in graphics.php in the Graphics comgraphics component 1.0.6 and 1.5.0 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...