Ubigeo de Peru < 3.6.4 - SQL Injection Detection

The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections. !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not properly sanitise and...

Atlassian Jira Confluence - Cross-Site Scripting Detection

Atlassian Jira Confluence before version 7.6.6, from version 7.7.0 before version 7.7.4, from version 7.8.0 before version 7.8.4, and from version 7.9.0 before version 7.9.2, allows remote attackers to inject arbitrary HTML or JavaScript via a cross-site scripting vulnerability in the error messa...

WatchGuard Fireware AD Helper Component - Credentials Disclosure Detection

WatchGuard Fireware Threat Detection and Response TDR service contains a credential-disclosure vulnerability in the AD Helper component that allows unauthenticated attackers to gain Active Directory credentials for a Windows domain in plaintext. !/usr/bin/env python3 -- coding: utf-8 --...

DedeCMS 5.7 SP2 - Cross-Site Scripting Detection

DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php,...

Zzzcms 1.75 - Information Disclosure Detection

There is a rather strange file that directly echoes some content belonging to the inaccessible zzzconfig.php. The information leakage file is located in plugins\webuploader\js\webconfig.php, and the management path name of the management background can be obtained directly. No need to blast admin...

Ansible Semaphore Panel Detect

An Ansible Semaphore login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Ansible Semaphore login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ansible Semaphore...

Azkaban Web Client Detection

An Azkaban web client panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Azkaban web client panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Azkaban Web Client Detection',...

Dahua Web Service Panel - Detect

A Dahua admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Dahua admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dahua Web Service Panel - Detect',...

Apache ShenYu Admin Unauth Access Detection

Apache ShenYu suffers from an unauthorized access vulnerability where a user can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1. !/usr/bin/env python3 -- coding: utf-8 -- """Apache ShenYu suffers from an unauthorized access vulnerability where a user...

Loan Management System 1.0 - SQL Injection

Auth bypass SQLi via username on /ajax.php?action=login. !/usr/bin/env python3 -- coding: utf-8 -- """Loan Management System 1.0 - SQL Injection""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Loan...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA...

Symfony Profiler - Remote Access via Injected Arguments Detection

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

Wordpress RDF User Enumeration Detection

Leaked Wordpress RDF leads to User Emumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked Wordpress RDF leads to User Emumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress RDF User...

Label Studio < 1.18.0 - Reflected XSS Detection

Label Studio 1.18.0 contains a stored XSS caused by improper sanitization in POST /projects/upload-example/ endpoint, letting attackers inject malicious scripts to hijack sessions and perform unauthorized actions, exploit requires sending crafted requests. !/usr/bin/env python3 -- coding: utf-8 -...

Ivanti Connect Secure - Stack-based Buffer Overflow Detection

Ivanti Connect Secure 22.7R2.5, Ivanti Policy Secure 22.7R1.2, and Ivanti Neurons for ZTA gateways 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS...

Jeecg-boot 3.5.0 qurestSql - SQL Injection Detection

A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. !/usr/bin/env python3 -- coding: utf-8 -- ""...

GitLab GraphQL API User Enumeration Detection

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, nam.""" fr...

Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exists in the Moodle LMS Jmol plugin version 6.1 and prior via the data parameter in jsmol.php. The application fails to properly sanitize user input before embedding it into the HTTP response, allowing an attacker to execute arbitrary JavaScript...

Roundcube ≤ 1.6.10 Post-Auth RCE (CVE-2025-49113)

Authenticated RCE in Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11. Unsafe from handling in settings/upload.php allows PHP object deserialization via a CryptGPGEngine gadget command execution as the web server user. !/usr/bin/env python3 -- coding: utf-8 -- """Roundcube ≤ 1.6.10 post-au...

Gradio - Server Side Request Forgery Detection

An SSRF Server-Side Request Forgery vulnerability exists in the gradio-app/gradio repository, allowing attackers to scan and identify open ports within an internal network. By manipulating the 'file' parameter in a GET request, an attacker can discern the status of internal ports based on the...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass

Kentico Staging SyncServer accepts UsernameToken without password WT-2025-0011. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging Service Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XWiki - Cross-Site Scripting Detection

XWiki is vulnerable to reflected Cross-Site Scripting XSS via the viewer=changes endpoint. The rev2 parameter is not properly sanitised before being rendered in the response, allowing an attacker to inject arbitrary JavaScript. Affects XWiki versions prior to the patched release. !/usr/bin/env...

phpLDAPadmin <= 1.2.3 - Reflected XSS Detection

phpLDAPadmin = 1.2.3 contains a reflected cross-site scripting caused by unsanitized input in htdocs/entrychooser.php via the form, element, rdn, or container parameter, letting attackers execute malicious scripts in victim browsers, exploit requires sending crafted input. !/usr/bin/env python3 -...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) Detection

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

Subrion CMS Web Installer - Exposure Detection

Subrion CMS Web Installer has been exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Subrion CMS Web Installer has been exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Subrion CMS Web Installer - Exposur...

AppVeyor Configuration Page - Detect

AppVeyor configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AppVeyor configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AppVeyor Configuration Page - Detect',...

Joe Editor DEADJOE File - Exposure Detection

Detected Deadjoe file,this file was created by Joe's Own Editor when a session terminated abnormally. It contained the full contents of the file being edited at the time of the crash, potentially exposing sensitive information such as passwords, configuration files, or credentials. !/usr/bin/env...

Copyparty <=1.18.6 - Cross-Site Scripting Detection

Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting XSS via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. !/usr/bin/env python3...

EventON Lite < 2.1.2 - Arbitrary File Download Detection

The plugin does not validate that the eventid parameter in its eventonicsdownload ajax action is a valid Event, allowing unauthenticated visitors to access any Post including unpublished or protected posts content via the ics export functionality by providing the numeric id of the post...

GLPI <9.4.6 - Open Redirect Detection

GLPI prior 9.4.6 contains an open redirect vulnerability based on a regexp. !/usr/bin/env python3 -- coding: utf-8 -- """GLPI prior 9.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GLPI 9.4.6 - Open...

PraisonAI AgentOS - Information Disclosure Detection

PraisonAI's AgentOS FastAPI application server exposes an unauthenticated GET /api/agents endpoint that lists every registered agent's name, role and the opening of its instructions system prompt. No authentication is enforced on the route, allowing a remote attacker to enumerate agent...

GLPI 9.2/<9.5.6 - Information Disclosure Detection

GLPI 9.2 and prior to 9.5.6 is susceptible to information disclosure via the telemetry endpoint, which discloses GLPI and server information. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """GL...

Uptime-Kuma < v1.23.0 - Improper Access Control Detection

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component Detection

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component. !/usr/bin/env python3 -- coding: utf-8 -- """SQL injection vulnerability in vipshop Saturn v.""" from kittysploit import...

FileMage Gateway - Directory Traversal Detection

Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component. !/usr/bin/env python3 -- coding: utf-8 -- """Directory Traversal vulnerability in FileMage Gateway...

Gradio - Open Redirect Detection

Gradio allows an open redirect bypass via URL encoding, enabling attackers to redirect users to malicious sites. This can lead to phishing attacks and loss of trust in the application. !/usr/bin/env python3 -- coding: utf-8 -- """Gradio allows an open redirect bypass via URL encoding, enabling...

Nginx UI < 2.3.3 - Information Disclosure Detection

Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. !/usr/bin/env python3 -- coding: utf-8 --...

ServiceNow UI Macros - Template Injection Detection

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted...

TecConnect OpenMessaging Webservice Detection

TecCom TecConnect OpenMessaging webservice was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TecCom TecConnect OpenMessaging webservice was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TecConnec...

Astro - Information Disclosure Detection

Astro versions v5.0.3 through v5.0.7 and Astro v4.16.17 or older with sourcemaps enabled contain a source code disclosure caused by sourcemap files being publicly accessible in the build output folder, letting unauthenticated users read server source code, exploit requires sourcemaps to be enable...

Moodle LTI module Reflected - Cross-Site Scripting Detection

A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI module. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's brows...

AEM QueryBuilder JSON Exposure - Bypass Detection

Adobe Experience Manager QueryBuilder endpoint allows unauthenticated attackers to extract sensitive user repository data, including password hashes from the rep:password field in /home/users. This vulnerability bypasses access controls and exposes bcrypt/SHA-256 password hashes through the...

Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution Detection

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...

ConnectWise Control Remote Support Software Panel - Detect

Detects ConnectWise Control Remote Support Software Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ConnectWise Control Remote Support Software Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

WordPress Wordfence 7.4.6 - Cross0Site Scripting Detection

WordPress Wordfence 7.4.6 is vulnerable to cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Wordfence 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Wordfence 7.4.6 -...

FreeIPA Identity Management Login Panel - Detect

FreeIPA Identity Management login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FreeIPA Identity Management login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FreeIPA Identit...

ImpressCMS Detect

Detects ImpressCMS Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ImpressCMS Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ImpressCMS Detect', 'description': 'Detects ImpressCMS...

WordPress Readme File Detection

Detects WordPress Readme File. !/usr/bin/env python3 -- coding: utf-8 -- """Detects WordPress Readme File.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Readme File Detection', 'description': 'Detects...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted ...

LVS Lean Value Management System Business - Directory Listing Detection

Multiple systems of Hangzhou Jila Technology Co., Ltd. have been found to have directory traversal vulnerabilities. These vulnerabilities arise from the inadequate access controls implemented in the /Business/ directory. Malicious actors can potentially leverage these vulnerabilities to illicitly...