Jolokia file write to RCE jfr Detection

File read and file write to RCE by deploying a vhost with MBeanFactory/createStandardHost and DiagnosticCommand/jfrStart !/usr/bin/env python3 -- coding: utf-8 -- """File read and file write to RCE by deploying a vhost with MBeanFactory/createStandardHost and DiagnosticComman.""" from kittysploit...

DBeaver Database Connections - Detect

DBeaver database connections were detected. !/usr/bin/env python3 -- coding: utf-8 -- """DBeaver database connections were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DBeaver Database Connections -...

Nginx UI < 2.3.3 - Information Disclosure Detection

Nginx UI 2.3.3 contains an information disclosure vulnerability caused by unauthenticated access to /api/backup endpoint exposing encryption keys in X-Backup-Security header, letting unauthenticated attackers download and decrypt full system backups. !/usr/bin/env python3 -- coding: utf-8 --...

Pandora FMS Installation Page - Exposure Detection

Detects exposed Pandora FMS installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed Pandora FMS installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pandora FMS Installation Page...

QCube Cross-Site-Scripting Detection

A reflected cross-site scripting vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in...

Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export Detection

The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. !/usr/bin/env python3 -- coding: utf-8 -- """The lack of proper authorisation when exporting...

Publicly accessible NPM Log file Detection

NPM log file is exposed to external users. !/usr/bin/env python3 -- coding: utf-8 -- """NPM log file is exposed to external users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Publicly accessible NPM Log file...

Krpano Panorama Viewer - Detection

Detected Krpano Panorama Viewer by identifying known Krpano-specific resources and response patterns. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Krpano Panorama Viewer by identifying known Krpano-specific resources and response patterns.""" from kittysploit import from...

Talroo Jobs Script 1.0 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

CMSimple 3.1 - Local File Inclusion Detection

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

Synology Web Station Page - Detect

Synology Web Station page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Web Station page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Synology Web Station Page - Detect',...

AWS Cloudfront service detection

Detect websites using AWS cloudfront service !/usr/bin/env python3 -- coding: utf-8 -- """Detect websites using AWS cloudfront service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Cloudfront service detection...

EVSE Web Interface Panel - Detection

Detects EVSE Web Interface Panel - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EVSE Web Interface Panel - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EVSE Web Interface Panel -...

WordPress Guppy <=1.1 - Information Disclosure Detection

WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another. !/usr/bin/env python3 -- coding:...

GnuBoard5 5.5.16 - Open Redirect Detection

Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard5 5.""" import re...

Teampass LDAP Debug Config - Detect

Teampass ldap.debug.txt config was detected. This file is generated on "/files/ldap.debug.txt" for versions earlier than 3.0.0.0 when utilizing the "Test current configuration" in LDAP settings. !/usr/bin/env python3 -- coding: utf-8 -- """Teampass ldap.""" from kittysploit import from...

ifw8 Router ROM v4.31 - Credential Discovery Detection

ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code. !/usr/bin/env python3 -- coding: utf-8 -- """ifw8 Router ROM v4.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Qualitor <= v8.24 - Server-Side Request Forgery Detection

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php. !/usr/bin/env python3 -- coding: utf-8 -- """Qualitor v8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Roundcube ≤ 1.6.10 Post-Auth RCE (CVE-2025-49113)

Authenticated RCE in Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11. Unsafe from handling in settings/upload.php allows PHP object deserialization via a CryptGPGEngine gadget command execution as the web server user. !/usr/bin/env python3 -- coding: utf-8 -- """Roundcube ≤ 1.6.10 post-au...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted ...

CyberPower - SQL Injection Detection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. !/usr/bin/env python3 -- coding: utf-8 -- """A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.""" from kittysploit import from lib.protocols.http.httpclient import...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

Phpmyfaq v3.1.11 - Cross-Site Scripting Detection

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized. !/usr/bin/env python3 -- coding: utf-8 -- """Phpmyfaq v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Wordpress RDF User Enumeration Detection

Leaked Wordpress RDF leads to User Emumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked Wordpress RDF leads to User Emumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress RDF User...

Zzzcms 1.75 - Information Disclosure Detection

There is a rather strange file that directly echoes some content belonging to the inaccessible zzzconfig.php. The information leakage file is located in plugins\webuploader\js\webconfig.php, and the management path name of the management background can be obtained directly. No need to blast admin...

GeoServer - Missing Authorization on REST API Index Detection

GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer contains a missing authorization vulnerability that allows...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting Detection

A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be executed remote...

Seeyon OA A6 initDataAssess.jsp - Information Disclosure Detection

Seeyon OA A6 initDataAssess.jsp has leaked user sensitive information, attacker can use the obtained username to blast the user's password to enter the background for further attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Seeyon OA A6 initDataAssess.""" from kittysploit import from...

UserGate NGFW/UTM Admin Panel - Detect

Detect UserGate NGFW/UTM Admin Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detect UserGate NGFW/UTM Admin Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UserGate NGFW/UTM Admin Panel - Detect',...

Apache Polaris - Information Disclosure Detection

Detects a Apache Polaris server, the interoperable, open source catalog for Apache Iceberg. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Polaris server, the interoperable, open source catalog for Apache Iceberg.""" from kittysploit import from lib.protocols.http.httpclient import...

WordPress Contact Form 7 - Full Path Disclosure Detection

The WordPress Contact Form 7 plugin was detected to be vulnerable to Full Path Disclosure, where direct access to PHP files revealed the full server filesystem path and could aid further exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Contact Form 7 plugin was detected to...

Apache Struts Dev Mode - Detect

Multiple Apache Struts applications were detected in dev-mode. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Apache Struts applications were detected in dev-mode.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

WordPress Wordfence - Rules File Disclosure Detection

The Wordfence Security plugin for WordPress stores configuration files in the /wp-content/wflogs/ directory. These files may be accessible without authentication and can expose sensitive configuration data, firewall rules, attack logs, and internal paths. !/usr/bin/env python3 -- coding: utf-8 --...

Elastic Cloud API Key Detection

Detects Elastic Cloud API keys used for programmatic access to the Elastic Cloud and serverless APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Elastic Cloud API keys used for programmatic access to the Elastic Cloud and serverless APIs.""" import re from kittysploit import from...

Brother Printer Detection

Brother Printer unauthorized access was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Brother Printer unauthorized access was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Brother Printer...

mooDating 1.2 - Cross-site scripting Detection

A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is...

Tomcat Stack Traces Enabled Detection

Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern.""" from kittysploit import from...

Ivanti Connect Secure - Stack-based Buffer Overflow Detection

Ivanti Connect Secure 22.7R2.5, Ivanti Policy Secure 22.7R1.2, and Ivanti Neurons for ZTA gateways 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS...

Cacti Weathermap File Write Detection

Cacti Weathermap a plugin for Cacti, an open-source network monitoring and graphing tool is vulnerable to file write. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti Weathermap a plugin for Cacti, an open-source network monitoring and graphing tool is vulnerable to fi.""" from kittysploit impo...

Spring Boot AuditEvents Actuator Panel - Detect

Spring Boot Auditevents Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Auditevents Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spring Boot...

Wanhu OA OfficeServerServlet - Arbitrary File Upload Detection

Wanhu OA officeserverservlet file upload vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Wanhu OA officeserverservlet file upload vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wanhu OA...

GTranslate < 2.8.65 - Cross-Site Scripting Detection

In the Pro and Enterprise versions of GTranslate 2.8.65, the gtranslaterequesturivar function runs at the top of all pages and echoes out the contents of $SERVER'REQUESTURI'. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable ...

Avalaunch FTP Service - Detect

Avalaunch FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Avalaunch FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Avalaunch FTP Servic...

Reprise License Manager 14.2 - Information Disclosure Detection

Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostnames, system architecture and file/directory...

Docker Container - Misconfiguration Exposure Detection

A Docker container misconfiguration was discovered. The Docker daemon can listen for Docker Engine API requests via three different types of Socket - unix, tcp, and fd. With tcp enabled, the default setup provides un-encrypted and un-authenticated direct access to the Docker daemon. It is...

IBM Security Access Manager Login Panel - Detect

IBM Security Access Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Security Access Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IBM Security...

Avatier Password Management Panel Detection

An Avatier password management panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Avatier password management panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avatier Password...

Squidex <7.4.0 - Cross-Site Scripting Detection

Squidex before 7.4.0 contains a cross-site scripting vulnerability via the squid.svg endpoint. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 --...

Morningstar ProStar MPPT Solar Charge Controller - Detect

Morningstar ProStar MPPT is a solar charge controller with a built-in web server providing live data monitoring for off-grid and industrial solar installations. The exposed interface displays real-time array, battery, and load data without authentication. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Simple Membership <4.1.1 - Cross-Site Scripting Detection

WordPress Simple Membership plugin before 4.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize and escape parameters before outputting them back in AJAX actions. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Simple Membership plugin before 4.""" fr...