Eibiz i-Media Server Digital Signage 3.8.0 - Local File Inclusion Detection

Eibiz i-Media Server Digital Signage 3.8.0 is vulnerable to local file inclusion. An unauthenticated remote attacker can exploit this to view the contents of files located outside of the server's root directory. The issue can be triggered through the oldfile GET parameter. !/usr/bin/env python3 -...

Elastic HD Dashboard Exposure Detection

Elastic HD Dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Elastic HD Dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elastic HD Dashboard Exposure Detection', 'description':...

Elemiz Network Manager Login Panel - Detect

Elemiz Network Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Elemiz Network Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Elemiz Network Manager...

Nortek Linear eMerge Panel - Detect

Nortek Linear eMerge panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nortek Linear eMerge panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nortek Linear eMerge Panel -...

eMessage Login Panel - Detect

eMessage login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """eMessage login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eMessage Login Panel - Detect',...

EmpireCMS Detect

Detects EmpireCMS Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EmpireCMS Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EmpireCMS Detect', 'description': 'Detects EmpireCMS Detect.'...

EMS Web Client Login Panel - Detect

EMS Web Client login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EMS Web Client login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EMS Web Client Login Panel - Detect',...

Endpoint Protector Login Panel - Detect

Endpoint Protector - Reporting and Administration Tool login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Endpoint Protector - Reporting and Administration Tool login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

EnvisionGateway Scheduler Panel - Detect

EnvisionGateway scheduler panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EnvisionGateway scheduler panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EnvisionGateway Scheduler Panel...

Envoy Proxy - Metadata Disclosure Detection

Detected misconfigured Envoy proxy instances that disclose sensitive information about the target infrastructure via the "x-envoy-peer-metadata" response header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected misconfigured Envoy proxy instances that disclose sensitive information about the...

Epson Printer Detection

An Epson printer web panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Epson printer web panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Epson Printer Detection',...

ERP-NC - Local File Inclusion Detection

ERP-NC is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """ERP-NC is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ERP-NC - Local File Inclusion...

Esafenet CDG mysql - File Read Detection

CDGServer3 Unauthorized File Download vulnerability is detected. !/usr/bin/env python3 -- coding: utf-8 -- """CDGServer3 Unauthorized File Download vulnerability is detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Eset Protect Login Panel - Detect

Login page for Eset Protect !/usr/bin/env python3 -- coding: utf-8 -- """Login page for Eset Protect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Eset Protect Login Panel - Detect', 'description': 'Login page for...

eSMTP - Config Discovery Detection

eSMTP configuration was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """eSMTP configuration was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'eSMTP - Config Discovery Detection', 'description':...

Espec Web Controller - Panel Detection

Espec Web Controller panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Espec Web Controller panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Espec Web Controller - Panel...

ETIC Telecom Device Login - Panel Detection

ETIC Telecom device login panel was discovered !/usr/bin/env python3 -- coding: utf-8 -- """ETIC Telecom device login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ETIC Telecom Device Login -...

Event Debug Server Status Detection

Exposes server status,logs and internal information. !/usr/bin/env python3 -- coding: utf-8 -- """Exposes server status,logs and internal information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Event Debug Serve...

Evidently AI Panel - Detect

Evidently AI is an ML/LLM observability platform for monitoring data drift and model performance. !/usr/bin/env python3 -- coding: utf-8 -- """Evidently AI is an ML/LLM observability platform for monitoring data drift and model performance.""" import re from kittysploit import from...

EvilGinx - Detect

Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection. !/usr/bin/env python3 -- coding: utf-8 -- """Evilginx2 is a man-in-the-middle attack framework used for phishing logi...

EVSE Web Interface Panel - Detection

Detects EVSE Web Interface Panel - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EVSE Web Interface Panel - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EVSE Web Interface Panel -...

EWM Manager Login Panel - Detect

EWM Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EWM Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EWM Manager Login Panel - Detect', 'description...

GnuBoard5 5.5.16 - Open Redirect Detection

Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard5 5.""" import re...

SiteGuard WP Plugin <= 1.7.6 - Login Page Disclosure Detection

The SiteGuard WP Plugin plugin for WordPress is vulnerable to protection mechanism bypass in all versions up to, and including, 1.7.6. This is due to the plugin not restricting redirects from wp-register.php which may disclose the login page URL. This makes it possible for unauthenticated attacke...

Bazarr < 1.4.3 - Arbitrary File Read Detection

Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Bazarr 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bazarr 1.4.3 - Arbitrary Fi...

iTop - User Enumeration via REST Endpoint Detection

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. !/usr/bin/env python3 -- coding: utf-8 --...

FleetCart 4.1.1 - Information Disclosure Detection

Issues with information disclosure in redirect responses. Accessing the majority of the website's pages exposes sensitive data, including the "Razorpay" "razorpayKeyId". !/usr/bin/env python3 -- coding: utf-8 -- """Issues with information disclosure in redirect responses.""" from kittysploit impo...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting Detection

A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be executed remote...

MasterSAM Star Gate v11 - Local File Inclusion Detection

MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information...

TP-Link Archer A20 v3 Router - Cross-site Scripting Detection

The TP-Link Archer A20 v3 router is vulnerable to Cross-site Scripting XSS due to improper handling of directory listing paths in the web interface. When a specially crafted URL is visited, the router's web page renders the directory listing and executes arbitrary JavaScript embedded in the URL...

AnythingLLM - Information Disclosure Detection

AnythingLLM suffers from an information disclosure vulnerability through the /api/setup-complete API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM...

Danswer - Insecure Direct Object Reference Detection

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. !/usr/bin/env python3 -- coding: utf-8 -- """The application does not verify whether the attacker is the creator...

WooCommerce Designer Pro <= 1.9.28 - Arbitrary File Read Detection

WooCommerce Designer Pro theme for WordPress = 1.9.28 contains an arbitrary file read vulnerability caused by improper input validation, letting unauthenticated attackers read arbitrary files including sensitive configuration files, exploit requires no authentication. !/usr/bin/env python3 --...

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read Detection

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

WordPress Print Invoice & Delivery Notes for WooCommerce <= 5.8.0 - Remote Code Execution Detection

Print Invoice & Delivery Notes for WooCommerce plugin for WordPress = 5.8.0 contains a remote code execution caused by missing capability check, PHP enabled in Dompdf, and missing escape in template.php, letting unauthenticated attackers execute code on the server. !/usr/bin/env python3 -- coding...

Pichome 2.1.0 - Arbitrary File Read Detection

A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The manipulation of the argument src leads to path traversal. It is possible to initiate the attack remotely. The exploit has been disclosed t...

InstaWP Connect < 0.1.0.86 - Local PHP File Inclusion Detection

The InstaWP Connect - 1-click WP Staging & Migration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.1.0.85 via the 'instawp-database-manager' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files ...

DAEnetIP4 METO v1.25 - Session Hijacking Detection

DAEnetIP4 METO v1.25 contains improper session management in the /loginok.htm endpoint, letting attackers hijack sessions, exploit requires attacker to control or intercept session tokens. !/usr/bin/env python3 -- coding: utf-8 -- """DAEnetIP4 METO v1.""" from kittysploit import from...

ETQ Reliance - Reflected XSS via SQLConverterServlet Detection

A reflected cross-site scripting XSS vulnerability exists in ETQ Reliance CG legacy platform within the SQLConverterServlet component. This vulnerability requires user interaction, such as clicking a crafted link, and may result in execution of unauthorized scripts in the user's context. The...

MapTiler Tileserver-php v2.0 - Unauthenticated File Read Detection

MapTiler Tileserver-php v2.0 contains a directory traversal caused by improper sanitization of GET parameters in renderTile function, letting attackers read arbitrary files on the server, exploit requires crafted web requests !/usr/bin/env python3 -- coding: utf-8 -- """MapTiler Tileserver-php...

JumpServer - Open Redirect via Referer Header Detection

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection target without proper validation, which could lead to an Open Redirect vulnerability. !/usr/bin/env...

Service Finder Bookings - Authentication Bypass Detection

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. !/usr/bin/env python3 -- coding: utf-8 -- """Service Finder Bookin...

Atarim < 4.2.2 - Sensitive Information Exposure Detection

Vito Peleg Atarim = 4.2 contains an insertion of sensitive information into sent data vulnerability caused by improper handling of embedded sensitive data, letting attackers retrieve embedded sensitive data remotely, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -...

Yonyou YonBIP - Path Traversal Detection

Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou YonBIP v3 and before...

Featured Image from URL (FIFU) <= 5.2.7 - Unauthenticated Information Exposure via Log File Detection

The Featured Image from URL FIFU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.2.7 through publicly exposed log files. This makes it possible for unauthenticated attackers to view potentially sensitive information contained in the...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation Detection

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. !/usr/bin/env python3 -- coding: utf-8 -- """Zoom WordPress plugin 4.""" from...

Modular DS - Broken Access Control

Modular Connector login endpoint issues wordpressloggedin cookie without auth. !/usr/bin/env python3 -- coding: utf-8 -- """Modular DS - Broken Access Control""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

OneUptime < 10.0.21 - Path Traversal Detection

OneUptime 10.0.21 contains a path traversal caused by unsanitized componentName parameter in /workflow/docs/:componentName endpoint, letting unauthenticated attackers read arbitrary files from the server filesystem. !/usr/bin/env python3 -- coding: utf-8 -- """OneUptime 10.""" import re from...

Dashy <= 4.3.6 - Reflected XSS via Workspace Detection

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

Cyberoam Firewall - Login Panel Detection

Cyberoam UTM firewall login panel detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberoam UTM firewall login panel detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cyberoam Firewall - Login Panel...