FirstClass FTP Service - Detect

FirstClass FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FirstClass FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'FirstClass FTP...

FreeIPA - XML Entity Injection Detection

Access to external entities when parsing XML documents can lead to XML external entity XXE attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. !/usr/bin/env python3 -- coding: utf-8 -- """Access to external...

eShop 3.0.4 - Cross-Site Scripting Detection

eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in. !/usr/bin/env python3 -- coding: utf-8 -- """eShop 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Ellipsis Human Presence Technology <= 2.0.8 - Cross Site Scripting Detection

The 'page' GET parameter of the inc/protected-forms-table.php file was affected by a reflected XSS vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The 'page' GET parameter of the inc/protected-forms-table.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

ifw8 Router ROM v4.31 - Credential Discovery Detection

ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code. !/usr/bin/env python3 -- coding: utf-8 -- """ifw8 Router ROM v4.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Flyte Console <0.52.0 - Server-Side Request Forgery Detection

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or...

Action Controller Exception - Page Detection

Detects Action Controller Exception - Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Action Controller Exception - Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Action Controller Exception - Page...

FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure Detection

FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates a valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device...

Symantec Encryption Server Login Panel - Detect

Symantec Encryption Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Symantec Encryption Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Symantec Encrypti...

osTicket Login Panel - Detect

osTicket login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """osTicket login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'osTicket Login Panel - Detect', 'description':...

Ivanti Sentry Panel - Detect

Ivanti Sentry panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Sentry panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ivanti Sentry Panel - Detect', 'description': 'Ivanti...

BioTime Web Login Panel - Detect

BioTime Web login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BioTime Web login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BioTime Web Login Panel - Detect',...

WordPress Tidio-form <=1.0 - Cross-Site Scripting Detection

WordPress tidio-form1.0 contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) Detection

Reflective Cross Site Scripting XSS vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escalate privileges via the APPHOST parameter at config/i18n/en/main.php. !/usr/bin/env python3 -- coding: utf-8 -- """Reflective Cross Site Scripting XSS...

Wgetrc Configuration File - Detect

Wgetrc configuration file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wgetrc configuration file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wgetrc Configuration File - Detect',...

Grafana v8.x - Arbitrary File Read Detection

Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is /public/plugins/NAME/, where NAME is the plugin ID for any installed plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana versions 8."""...

Node-RED - Unauthenticated Access Detection

Node-RED flow editor is accessible without authentication. Node-RED is a flow-based programming tool that can execute arbitrary system commands, read/write files, and make network requests. Unauthenticated access leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RE...

IND780 - Local File Inclusion Detection

IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 SS Label 'IND7808.0.07', Version 7.2.10 June 18, 2012 SS Label 'IND7807.2.10' is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the...

Dlink DSR-250 and Netgear Prosafe - Cross-Site Scripting Detection

Dlink DSR-250 and Netgear Prosafe are vulnerable to reflected cross site scripting endpoint scgi-bin/platform.cgi in parameter SSLVPN. !/usr/bin/env python3 -- coding: utf-8 -- """Dlink DSR-250 and Netgear Prosafe are vulnerable to reflected cross site scripting endpoint scgi-bin/platform.""" fro...

Icecast Streaming Media Server Detection

Detects Icecast Streaming Media Server Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Icecast Streaming Media Server Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Icecast Streaming Media...

Webigniter 28.7.23 - Cross-Site Scripting Detection

The value of the redirect request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ycsz3"alert1bn76w was submitted in the redirect parameter. This input was echoed unmodified in the application's response. By using this Java...

CKAN DataStore SQL Search - SQL Injection Detection

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN, an open-source data management system used for powering open data...

WordPress Plugin Media Gallery Pro Listing Detection

Searches for sensitive directories present in the easy-media-gallery-pro plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the easy-media-gallery-pro plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Dialogic XMS Admin Console - Detect

Detects Dialogic XMS Admin Console - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dialogic XMS Admin Console - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dialogic XMS Admin Console -...

SMTP WP Plugin Directory Listing Detection

The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Easy WP SMTP Plugin has its log folder remotely accessible and its content available for access.""" from kittysploit import fro...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting Detection

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsystic Contact Form plugin before 1."""...

Chroma DB - Information Disclosure Detection

Chroma DB API endpoints were accessible and exposed collection metadata, enabling enumeration of collections under the default tenant and database, potentially leading to sensitive vector data disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Chroma DB API endpoints were accessible and...

Apache Server Status Disclosure Detection

Apache /server-status displays information about your Apache status. If you are not using this feature, disable it. !/usr/bin/env python3 -- coding: utf-8 -- """Apache /server-status displays information about your Apache status.""" from kittysploit import from lib.protocols.http.httpclient impor...

D-LINK DNS-320L,DNS-320LW and DNS-327L - Information Disclosure Detection

A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/info.cgi of the component HTTP GET Request Handler. !/usr/bin/env python3 -- coding: utf-8 -- """...

NETGEAR - Authentication Bypass Detection

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations...

Axigen WebMail - Cross-Site Scripting Detection

Cross Site Scripting XSS vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allows authenticated attackers to execute arbitrary code and obtain sensitive information via the logic for switching between the Standard and Ajax versions...

openDCIM - Detect

openDCIM is a web-based data centre infrastructure management application. !/usr/bin/env python3 -- coding: utf-8 -- """openDCIM is a web-based data centre infrastructure management application.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Draytek VigorConnect 1.6.0-B - Local File Inclusion Detection

Draytek VigorConnect 1.6.0-B3 is susceptible to local file inclusion in the file download functionality of the DownloadFileServlet endpoint. An unauthenticated attacker could leverage this vulnerability to download arbitrary files from the underlying operating system with root privileges...

Extreme Management Center 8.4.1.24 - Cross-Site Scripting Detection

Extreme Management Center 8.4.1.24 contains a cross-site scripting vulnerability via a parameter in a GET request. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

PrNET FTP Service - Detect

PrNET FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PrNET FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'PrNET FTP Service - Detect',...

WordPress Product Slider Pro - Supply Chain Backdoor RCE

Compromised Product Slider Pro builds execute attacker-controlled expressions via X-Cache-Status/X-Cache-Key headers. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Product Slider Pro for WooCommerce - Supply Chain Backdoor RCE""" import base64 import secrets from kittysploit import from...

Canon R-ADV C3325 - Unauth Detection

Canon R-ADV C3325 unauthenticated dashboard has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Canon R-ADV C3325 unauthenticated dashboard has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

DedeCMS 5.7.87 - Directory Traversal Detection

Directory traversal vulnerability in DedeCMS 5.7.87 allows reading sensitive files via the $activepath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Directory traversal vulnerability in DedeCMS 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HP iLO Serial Key - Detect

HP iLO serial key was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HP iLO serial key was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HP iLO Serial Key - Detect', 'description': 'HP iLO serial...

STUN Service Detection

Detects STUN RFC 5389 servers with a Binding Request on UDP 3478. !/usr/bin/env python3 -- coding: utf-8 -- """Detect STUN servers via Binding Request.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.stun.detectors import probestun class...

Vite dev server - Cross-Site Scripting Detection

Vite's dev server, when used with appType: 'custom' and manually invoking server.transformIndexHtml using the unmodified request URL, is vulnerable to XSS via a crafted URL payload. If the HTML being served includes an inline module script ..., an attacker can inject a script via the URL,...

WordPress AI Engine Plugin - Token Exposure Detection

Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.1.3 exposes bearer tokens via REST API endpoints when No-Auth URL is enabled. !/usr/bin/env python3 -- coding: utf-8 -- """Unauthenticated sensitive information exposure in AI Engine WordPress plugin = 3.""" import r...

Rancher - Incomplete Setup Exposure Detection

Detected Rancher installation was found with an incomplete first-time setup. The bootstrap login page was publicly accessible at /dashboard/auth/login, indicating an unconfigured instance that could have been targeted for unauthorized setup completion. !/usr/bin/env python3 -- coding: utf-8 --...

Simple CRM 3.0 SQL Injection and Authentication Bypass Detection

Simple CRM 3.0 is susceptible to SQL injection and authentication bypass vulnerabilities. !/usr/bin/env python3 -- coding: utf-8 -- """Simple CRM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Simple CRM 3.0 SQL...

WordPress FoodBakery <2.2 - Cross-Site Scripting Detection

WordPress FoodBakery before 2.2 contains an unauthenticated reflected cross-site scripting vulnerability. It does not properly sanitize the foodbakeryradius parameter before outputting it back in the response. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress FoodBakery before 2.""" from...

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting Detection

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. !/usr/bin/env python3 -- coding: utf-8 --...

GrandNode 4.40 - Local File Inclusion Detection

GrandNode 4.40 is susceptible to local file inclusion in Controllers/LetsEncryptController.cs, which allows remote unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests. !/usr/bin/env python3 -- coding: utf-8 --...

Flatpress < 1.3 - Path Traversal Detection

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. !/usr/bin/env python3 -- coding: utf-8 -- """Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Opsview Monitor Pro - Local File Inclusion Detection

Opsview Monitor Pro prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch is vulnerable to unauthenticated local file inclusion and can be exploited by issuing a specially crafted HTTP GET request utilizing a simple bypass...

CGI Test page Detection

Detects CGI Test page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CGI Test page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CGI Test page Detection', 'description': 'Detects CGI Test page.', 'author':...