Neos CMS Login Panel - Detect

Neos CMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Neos CMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Neos CMS Login Panel - Detect', 'description': 'Neos...

WordPress Plugin Media Gallery Pro Listing Detection

Searches for sensitive directories present in the easy-media-gallery-pro plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the easy-media-gallery-pro plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress SEO Plugin Rank Math - Full Path Disclosure Detection

WordPress Rank Math SEO plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Rank Math SEO plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Qlik Sense Server Panel - Detect

Qlik Sense Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qlik Sense Server panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qlik Sense Server Panel - Detect', 'description...

Qualcomm 4G LTE WiFi VoIP Router Panel - Detect

Qualcomm 4G LTE Wifi VoIP router panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qualcomm 4G LTE Wifi VoIP router panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qualcomm 4G LTE...

Google Api Private Key Detection

Google API private keys are exposed in files. !/usr/bin/env python3 -- coding: utf-8 -- """Google API private keys are exposed in files.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Api Private Key...

WordPress Candidate Application Form <= 1.3 - Local File Inclusion Detection

WordPress Candidate Application Form = 1.3 is susceptible to arbitrary file downloads because the code in downloadpdffile.php does not do any sanity checks. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Candidate Application Form = 1.""" import re from kittysploit import from...

Cacti - Guest User Access Enabled Detection

Cacti instance has guest user access enabled, allowing unauthenticated users to access graphview.php and potentially other resources. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti instance has guest user access enabled, allowing unauthenticated users to access graphview.""" from kittysploit...

D-Link Network Attached Storage - Backdoor Account Detection

A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user...

Gitea Installer Exposure Detection

Gitea is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Gitea is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Grafana 3.0.1-7.0.1 - Server-Side Request Forgery Detection

Grafana 3.0.1 through 7.0.1 is susceptible to server-side request forgery via the avatar feature, which can lead to remote code execution. Any unauthenticated user/client can make Grafana send HTTP requests to any URL and return its result. This can be used to gain information about the network...

Tongda OA v2014 Get Contactlistt - Sensitive Information Disclosure Detection

There is an information leakage vulnerability in the getcontactlist.php file of Tongda OA v2014. Attackers can obtain sensitive information through the vulnerability and conduct further attacks. !/usr/bin/env python3 -- coding: utf-8 -- """There is an information leakage vulnerability in the...

Hikvision Panel Detection

Detects Hikvision Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Hikvision Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info = 'name': 'Hikvision Panel Detection',...

WordPress Jannah Theme <5.4.4 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme...

SonicWall Email Security Panel - Detect

SonicWall Email Security panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall Email Security panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.osint.faviconhash import shodanmmh3 class ModuleScanner, Httpclient: info...

Craft CMS Detect

Detects Craft CMS !/usr/bin/env python3 -- coding: utf-8 -- """Detects Craft CMS.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Craft CMS Detect', 'description': 'Detects Craft CMS', 'author': 'KittySploi...

Apache Tomcat Remote Command Execution Detection

When using Apache Tomcat versions 10.0.0-M1 to 10.0.0-M4, 9.0.0.M1 to 9.0.34, 8.5.0 to 8.5.54 and 7.0.0 to 7.0.103 if a an attacker is able to control the contents and name of a file on the server; and b the server is configured to use the PersistenceManager with a FileStore; and c the...

Atlassian Connect Descriptor - Detect

The app descriptor is a JSON file atlassian-connect. json that describes the app to the Atlassian application. The descriptor includes general information for the app, as well as the modules that the app wants to use or extend. !/usr/bin/env python3 -- coding: utf-8 -- """The app descriptor is a...

BeyondTrust Privileged Access Management Login - Detect

BeyondTrust Privileged Access Management login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """BeyondTrust Privileged Access Management login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ModX CMS - Unfinished Installation Detection

Detected accessible ModX CMS installation or setup pages that indicated an incomplete installation.An exposed installation interface allowed attackers to complete the setup process and gain administrative access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected accessible ModX CMS installati...

EventON <= 2.1 - Missing Authorization Detection

The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventonicsdownload ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id. !/usr/bin/env python3 -- coding: utf-8 -- """The EventON WordPres...

aws-ecs-container-agent-tasks Detection

Aws container metadata content !/usr/bin/env python3 -- coding: utf-8 -- """Aws container metadata content.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'aws-ecs-container-agent-tasks Detection', 'description': 'Aw...

Node-RED - Unauthenticated Access Detection

Node-RED flow editor is accessible without authentication. Node-RED is a flow-based programming tool that can execute arbitrary system commands, read/write files, and make network requests. Unauthenticated access leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Node-RE...

Liferay /api/axis - API Exposed Detection

Detects Liferay /api/axis - API Exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Liferay /api/axis - API Exposed.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Liferay /api/axis - API Exposed...

XWiki - HQL Injection Detection

XWiki is vulnerable to Hibernate Query Language HQL injection in the wiki and space search REST API starting in version 4.3-milestone-1 and prior to versions 16.10.9, 17.4.2, and 17.5.0. The vulnerability allows attackers to inject malicious HQL queries through the orderField parameter, potential...

Microsoft SharePoint - Web Services Discovery Detection

Detected exposed SharePoint web services via /vtibin/spdisco.aspx endpoint !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint web services via /vtibin/spdisco.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

YApi Detect

Detects YApi Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects YApi Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YApi Detect', 'description': 'Detects YApi Detect.', 'author': 'KittySploit Team'...

GitLab CE/EE - Hard-Coded Credentials Detection

GitLab CE/EE contains a hard-coded credentials vulnerability. A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML, allowing attackers to potentially take over accounts. This template attempts to passively identify vulnerable versions of GitLab...

MODx manager - Local File Inclusion Detection

A directory traversal vulnerability in manager/controllers/default/resource/tvs.php in MODx Revolution 2.0.2-pl and possibly earlier allows remote attackers to read arbitrary files via a .. dot dot in the classkey parameter when magicquotesgpc is disabled. !/usr/bin/env python3 -- coding: utf-8 -...

WordPress Emergency Script Detection

Exposed wordpress password reset emergency script. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed wordpress password reset emergency script.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress Emergency...

Tautulli Panel - Unauthenticated Access Detection

Detects Tautulli Panel - Unauthenticated Access. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Tautulli Panel - Unauthenticated Access.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tautulli Panel -...

WordPress WP-Advanced-Search <= 3.3.9 - SQL Injection Detection

The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated...

Ampache Music Installer Detection

Ampache Music is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Ampache Music is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

Pallets Werkzeug <0.15.5 - Local File Inclusion Detection

Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names such as C: in Windows pathnames. !/usr/bin/env python3 -- coding: utf-8 -- """Pallets Werkzeug before 0.""" from kittysploit import from lib.protocols.http.httpclient import...

Webalizer Log Analyzer Configuration - Detect

Webalizer log analyzer configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Webalizer log analyzer configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Webalizer Log Analyze...

Cacti - Full Path Disclosure Detection

Detected a Full Path Disclosure FPD in Cacti when the log file is not writable. The error message reveals the absolute path of the log file on the server. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a Full Path Disclosure FPD in Cacti when the log file is not writable.""" import re from...

Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion Detection

A directory traversal vulnerability in jphone.php in the JPhone comjphone component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

WordPress S3 Video <=0.983 - Cross-Site Scripting Detection

WordPress S3 Video and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

Joomla! Component com_cartweberp - Local File Inclusion Detection

A directory traversal vulnerability in the CARTwebERP comcartweberp component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the...

Weights & Biases - Detect

Weights & Biases W&B instance was detected. W&B is a popular MLOps platform for experiment tracking, model versioning, and collaborative ML development. Self-hosted deployments expose the full experiment management interface. !/usr/bin/env python3 -- coding: utf-8 -- """Weights & Biases W&B...

Jeedom <=4.0.38 - Cross-Site Scripting Detection

Jeedom through 4.0.38 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Jeedom through 4.""" from kittysploit import from...

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting Detection

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sa."""...

Nginx Vhost Traffic Status Detection

Nginx Vhost Traffic status is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx Vhost Traffic status is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Vhost Traffic Status Detection',...

D-Link NAS `sc_mgr.cgi` - Remote Code Execution Detection

The D-Link NAS interface scmgr.cgi contains a command execution vulnerability that allows attackers to execute arbitrary commands on the device, potentially leading to unauthorized access or control over the system. !/usr/bin/env python3 -- coding: utf-8 -- """The D-Link NAS interface scmgr."""...

Yearning - Directory Traversal Detection

Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning. !/usr/bin/env python3 -- coding: utf-8 -- """Yearning has a directory traversal vulnerability that can be exploited b...

WAVLINK WN533A8 - Improper Access Control Detection

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

WordPress e-search <=1.0 - Cross-Site Scripting Detection

WordPress e-search 1.0 and before contains a reflected cross-site scripting vulnerability via titleaz.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

SABnzbd Quick-Start Wizard - Exposure Detection

Default installation wizard page of SABnzbd was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Default installation wizard page of SABnzbd was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read Detection

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

DedeCMS 5.7 SP2 - Cross-Site Scripting Detection

DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php,...