Artifactory anonymous deploy Detection

Artifactory anonymous repo is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Artifactory anonymous repo is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Artifactory anonymous deploy Detection',...

Lidarr Dashboard - Unauthenticated Detection

Exposed Lidarr was detected which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Lidarr was detected which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WoW CMS Installer Exposure Detection

WoW CMS is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """WoW CMS is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

x-amz-meta-s3cmd-attrs Header Username Disclosure Detection

Detected exposure of the x-amz-meta-s3cmd-attrs header in S3 objects, which can disclose sensitive information including the username uname, user ID uid, group name gname, and group ID gid of the user who uploaded the file using s3cmd. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposur...

FXServer < v9601 - Information Exposure Detection

Incorrect Access Control in FXServer version's v9601 and prior, for CFX.re FiveM, allows unauthenticated users to modify and read userdata via exposed api endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """Incorrect Access Control in FXServer version's v9601 and prior, for CFX.""" from...

AmpGuard Wifi Setup Detection

AmpGuard wifi setup panel detected. !/usr/bin/env python3 -- coding: utf-8 -- """AmpGuard wifi setup panel detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AmpGuard Wifi Setup Detection', 'description':...

Epson Printer Detection

An Epson printer web panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Epson printer web panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Epson Printer Detection',...

IND780 - Local File Inclusion Detection

IND780 Advanced Weighing Terminals Build 8.0.07 March 19, 2018 SS Label 'IND7808.0.07', Version 7.2.10 June 18, 2012 SS Label 'IND7807.2.10' is vulnerable to unauthenticated local file inclusion. It is possible to traverse the folders of the affected host by providing a relative path to the...

Alerta < 8.1.0 - Authentication Bypass Detection

Alerta prior to version 8.1.0 is prone to authentication bypass when using LDAP as an authorization provider and the LDAP server accepts Unauthenticated Bind requests. !/usr/bin/env python3 -- coding: utf-8 -- """Alerta prior to version 8.""" from kittysploit import from...

Jira Unauthenticated Access to screens Detection

Detects Jira Unauthenticated Access to screens. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jira Unauthenticated Access to screens.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jira Unauthenticated Access...

Joomla! Component Archery Scores 1.0.6 - Local File Inclusion Detection

A directory traversal vulnerability in archeryscores.php in the Archery Scores comarcheryscores component 1.0.6 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """...

BigAnt Admin Login Panel - Detect

BigAnt admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BigAnt admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BigAnt Admin Login Panel - Detect',...

Microweber Information Disclosure Detection

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. !/usr/bin/env python3 -- coding: utf-8 -- """Microweber contains a vulnerability that allows exposure of sensitive information to an...

Joomla! Component SVMap 1.1.1 - Local File Inclusion Detection

A directory traversal vulnerability in the SVMap comsvmap component 1.1.1 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the SVMap comsvmap...

Versa Director API Endpoint Detection

Versa Director API Endpoint Unauthorized Detection !/usr/bin/env python3 -- coding: utf-8 -- """Versa Director API Endpoint Unauthorized Detection.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Versa...

Zyxel ZyWal/USG/UAG Devices - Cross-Site Scripting Detection

Zyxel ZyWall, USG, and UAG devices allow remote attackers to inject arbitrary web script or HTML via the errmsg parameter freetimefailed.cgi CGI program, aka reflective cross-site scripting. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel ZyWall, USG, and UAG devices allow remote attackers to...

Unauthorized HP Printer Detection

HP Printer is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """HP Printer is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unauthorized HP Printer Detection', 'description': 'HP Printer is exposed.',...

OX Appsuite - Cross-Site Scripting Detection

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI. !/usr/bin/env python3 -- coding: utf-8 -- """OX App Suite through 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Busybox Repository Browser - Detect

Busybox Repository Browser was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Busybox Repository Browser was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Busybox Repository Browser - Detect',...

Vipshop Saturn Console <= 3.5.1 - SQL Injection via ClusterKey Component Detection

SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClusterKey component. !/usr/bin/env python3 -- coding: utf-8 -- """SQL injection vulnerability in vipshop Saturn v.""" from kittysploit import...

Fortra GoAnywhere MFT - Authentication Bypass Detection

Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. !/usr/bin/env python3 -- coding: utf-8 -- """Authentication bypass in Fortra's GoAnywhere MFT prior to 7.""" from kittysploit import from...

Jolokia Java Heap Information Disclosure Detection

Detects Jolokia Java Heap Information Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jolokia Java Heap Information Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jolokia Java Heap...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the newpassword1 parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

qdPM 9.2 - Directory Traversal Detection

qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. !/usr/bin/env python3 -- coding: utf-8 -- """qdPM 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'qdPM 9.2 -...

HotelDruid 2.3.0 - Cross-Site Scripting Detection

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. !/usr/bin/env python3 -- coding: utf-8 -- """HotelDruid 2.""" from kittysploit import from...

NetScaler Console - Panel Detection

NetScaler Console login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """NetScaler Console login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NetScaler Console - Panel...

WordPress Plugin Safe SVG - Full Path Disclosure Detection

WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress Blogroll Fun-Show Last Post and Last Update Time 0.8.4 - Cross-Site Scripting Detection

WordPress Plugin Blogroll Fun-Show Last Post and Last Update Time 0.8.4 and possibly prior versions are prone to a cross-site scripting vulnerability because of a failure to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser ...

WordPress Pie Register < 3.7.2.4 - Open Redirect Detection

WordPress Pie Register 3.7.2.4 is susceptible to an open redirect vulnerability because the plugin passes unvalidated user input to the wpredirect function. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pie Register 3.""" import re from kittysploit import from lib.protocols.http.httpclie...

Unauthenticated Gloo UI Detection

Gloo UI is exposed to external users. !/usr/bin/env python3 -- coding: utf-8 -- """Gloo UI is exposed to external users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unauthenticated Gloo UI Detection',...

BitKeeper Configuration - Detect

BitKeeper configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BitKeeper configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BitKeeper Configuration - Detect', 'description...

Label Studio - Sign-up Detect

Detects the presence of the Label Studio sign-up. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the presence of the Label Studio sign-up.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Label Studio - Sign-up...

iBarn Installer - Exposure Detection

Detects the exposure of the iBarn installer page, which could allow unauthorized setup or reinstallation of the application. !/usr/bin/env python3 -- coding: utf-8 -- """Detects the exposure of the iBarn installer page, which could allow unauthorized setup or reinstallation of th.""" from...

ImageResizer Debug - Information Exposure Detection

The ImageResizer debug endpoint exposes sensitive server configuration and path information. !/usr/bin/env python3 -- coding: utf-8 -- """The ImageResizer debug endpoint exposes sensitive server configuration and path information.""" from kittysploit import from lib.protocols.http.httpclient impo...

Jackett UI - Unauthenticated Detection

The Jackett UI can be accessed without authentication, potentially exposing sensitive information and configuration settings to unauthorized users. !/usr/bin/env python3 -- coding: utf-8 -- """The Jackett UI can be accessed without authentication, potentially exposing sensitive information and...

Amazon ECS Sample App Default Page - Detect

Amazon ECS Sample App Default Page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Amazon ECS Sample App Default Page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Amazon ECS Sample App...

Huijietong - Local File Inclusion Detection

Huijietong is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Huijietong is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Huijietong -...

HomeWorks Illumination Web Keypad Detection

HomeWorks Illumination Web Keypad panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """HomeWorks Illumination Web Keypad panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HomeWorks...

WhoDB < 0.45.0 - Path Traversal Detection

WhoDB contains a path traversal caused by lack of validation when opening database files, letting unauthenticated attackers access arbitrary Sqlite3 databases on the host system, exploit requires attacker to manipulate database filename input. !/usr/bin/env python3 -- coding: utf-8 -- """WhoDB...

LimeSurvey Survey Software - Detect

Limesurvey is the number one open-source survey software. Advanced features like branching and multiple question types make it a valuable partner for survey-creation. !/usr/bin/env python3 -- coding: utf-8 -- """Limesurvey is the number one open-source survey software.""" from kittysploit import...

Bazaar Configuration - Detect

Bazaar configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Bazaar configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bazaar Configuration - Detect', 'description': 'Bazaa...

OXF Phishing as a Service Panel - Detect

OXF Phishing as a Service Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """OXF Phishing as a Service Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OXF Phishing as a Service...

OpenResty detection

Some deployments of OpenResty spill their version numbers. !/usr/bin/env python3 -- coding: utf-8 -- """Some deployments of OpenResty spill their version numbers.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Webtools Home Detection

Webtools panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Webtools panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Webtools Home Detection', 'description': 'Webtools panel was...

Monstra Admin Panel - Detect

Monstra admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Monstra admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Monstra Admin Panel - Detect', 'description': 'Monstra...

Cisco ASA - Local File Inclusion Detection

Cisco Adaptive Security Appliances ASA web interfaces could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. It is also possible on certain software releases that the ASA will not reload, but an attacker...

Jenkins - Remote Command Injection Detection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...

D-Link Routers - Remote Command Injection Detection

D-Link DWR-116 through 1.06, DWR-512 through 2.02, DWR-712 through 2.02, DWR-912 through 2.02, DWR-921 through 2.02, and DWR-111 through 1.01 device may allow an authenticated attacker to execute arbitrary code by injecting the shell command into the chkisg.htm page Sip parameter. This allows for...

XiongMai uc-httpd 1.0.0 - Buffer Overflow Detection

Buffer overflow in XiongMai uc-httpd 1.0.0 has unspecified impact and attack vectors, a different vulnerability than CVE-2017-16725. !/usr/bin/env python3 -- coding: utf-8 -- """Buffer overflow in XiongMai uc-httpd 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Eaton Intelligent Power Manager 1.6 - Directory Traversal Detection

Eaton Intelligent Power Manager v1.6 allows an attacker to include a file via directory traversal, which can lead to sensitive information disclosure, denial of service and code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Eaton Intelligent Power Manager v1.""" import re from kittysplo...