Cacti - Full Path Disclosure Detection

Detected a Full Path Disclosure FPD in Cacti when the log file is not writable. The error message reveals the absolute path of the log file on the server. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a Full Path Disclosure FPD in Cacti when the log file is not writable.""" import re from...

Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion Detection

A directory traversal vulnerability in jphone.php in the JPhone comjphone component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

WordPress S3 Video <=0.983 - Cross-Site Scripting Detection

WordPress S3 Video and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

Joomla! Component com_cartweberp - Local File Inclusion Detection

A directory traversal vulnerability in the CARTwebERP comcartweberp component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the...

Weights & Biases - Detect

Weights & Biases W&B instance was detected. W&B is a popular MLOps platform for experiment tracking, model versioning, and collaborative ML development. Self-hosted deployments expose the full experiment management interface. !/usr/bin/env python3 -- coding: utf-8 -- """Weights & Biases W&B...

Jeedom <=4.0.38 - Cross-Site Scripting Detection

Jeedom through 4.0.38 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Jeedom through 4.""" from kittysploit import from...

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting Detection

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sa."""...

Ncomputing vSPace Pro 10 and 11 - Directory Traversal Detection

Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import...

Nginx Vhost Traffic Status Detection

Nginx Vhost Traffic status is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx Vhost Traffic status is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Vhost Traffic Status Detection',...

D-Link NAS `sc_mgr.cgi` - Remote Code Execution Detection

The D-Link NAS interface scmgr.cgi contains a command execution vulnerability that allows attackers to execute arbitrary commands on the device, potentially leading to unauthorized access or control over the system. !/usr/bin/env python3 -- coding: utf-8 -- """The D-Link NAS interface scmgr."""...

Yearning - Directory Traversal Detection

Yearning has a directory traversal vulnerability that can be exploited by attackers to obtain sensitive information. The vulnerability is present in multiple versions of Yearning. !/usr/bin/env python3 -- coding: utf-8 -- """Yearning has a directory traversal vulnerability that can be exploited b...

WAVLINK WN533A8 - Improper Access Control Detection

WAVLINK WN533A8 M33A8.V5030.190716 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/sysinit.shtml?r=52300 and searching for logincheckuser; and thereby possibly obtain sensitive information, modify data, and/or execute...

WordPress e-search <=1.0 - Cross-Site Scripting Detection

WordPress e-search 1.0 and before contains a reflected cross-site scripting vulnerability via titleaz.php which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

SABnzbd Quick-Start Wizard - Exposure Detection

Default installation wizard page of SABnzbd was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Default installation wizard page of SABnzbd was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read Detection

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

DedeCMS 5.7 SP2 - Cross-Site Scripting Detection

DedeCMS 5.7 SP2 is vulnerable to cross-site scripting via the function named GetPageList defined in the include/datalistcp.class.php file that is used to display the page numbers list at the bottom of some templates, as demonstrated by the PATHINFO to /member/index.php, /member/pm.php,...

Casdoor - Authorization Bypass Detection

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. !/usr/bin/env python3 -- coding: utf-8 -- """Casdoor up to 1.""" from kittysploit import from...

Readarr Dashboard - Unauthenticated Detection

Exposure of Readarr dashboard which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Readarr dashboard which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

FlatnuX CMS - Directory Traversal Detection

A path traversal vulnerability in controlcenter.php in FlatnuX CMS 2011 08.09.2 allows remote administrators to read arbitrary files via a full pathname in the dir parameter in a contents/Files action. !/usr/bin/env python3 -- coding: utf-8 -- """A path traversal vulnerability in controlcenter.""...

vBulletin - Open Redirect Detection

vBulletin 3.x.x and 4.2.x through 4.2.5 contains an open redirect vulnerability via the redirector.php URL parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding...

Modular DS - Broken Access Control

Modular Connector login endpoint issues wordpressloggedin cookie without auth. !/usr/bin/env python3 -- coding: utf-8 -- """Modular DS - Broken Access Control""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Shopizer Detection

Detects Shopizer Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Shopizer Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Shopizer Detection', 'description': 'Detects Shopizer Detection.',...

Nginx UI Panel - Detect

Nginx UI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx UI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx UI Panel - Detect', 'description': 'Nginx UI panel was...

Ozeki 10 SMS Gateway 10.3.208 - Arbitrary File Read Detection

An arbitrary file read vulnerability, also known as a "path traversal" or "directory traversal" vulnerability, occurs when an attacker is able to access files on a system that they shouldn't have access to. This vulnerability arises from improper input validation or insufficient access controls i...

Oauth Credentials Json Detection

Oauth Credentials file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Oauth Credentials file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oauth Credentials Json Detection', 'description':...

FortiClient Endpoint Management Server Panel - Detect

Detects FortiClient Endpoint Management Server Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects FortiClient Endpoint Management Server Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Microsoft SharePoint - Site Pages Disclosure Detection

Microsoft SharePoint Site Pages library /SitePages/ is accessible without proper authentication, exposing site content, page structure, and potentially sensitive information. The Site Pages library contains modern SharePoint pages .aspx files !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft...

Generic Database File - Exposure Detection

This is collection of some web frameworks recommendation or default configuration for SQLite database file location. If this file is publicly accessible due to server misconfiguration, it could result in application data leak including users sensitive data, password hashes etc. !/usr/bin/env...

Matomo (Piwik) RUM - Tech Detect

Detects Matomo formerly Piwik Web Analytics & RUM artifacts. Identifies Standard Tracking, Image Tracking, Tag Manager, and Cloud instances using strict matching. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Matomo formerly Piwik Web Analytics & RUM artifacts.""" import re from kittysploi...

Splunk HEC - Detect

Splunk HCE HTTP Event Collector HEC was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk HCE HTTP Event Collector HEC was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Splunk HEC - Detect',...

SAPControl ABAPReadSyslog - Disclosure Detection

Detected SAP systems where the SAPControl SOAP web service exposes the ABAPReadSyslog operation without authentication. ABAPReadSyslog returns the ABAP system log equivalent to transaction SM21 via SAPControl sapstartsrv and includes fields such as client, username, transaction code, message...

Redash Installer Exposure Detection

Redash is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Redash is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Advanced Responsive Video Embedder - Full Path Disclosure Detection

WordPress Advanced Responsive Video Embedder plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Advanced Responsive Video Embedder...

TinaCMS - Path Traversal Detection

TinaCMS CLI 2.1.8 contains a file system read vulnerability caused by disabled Vite server.fs.strict setting, letting unauthenticated attackers read arbitrary files on the host system, exploit requires access to the dev server. !/usr/bin/env python3 -- coding: utf-8 -- """TinaCMS CLI 2.""" from...

SiteMinder - DOM Cross-Site Scripting Detection

SiteMinder contains a cross-site scripting vulnerability in the document object model. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other...

SAPControl Webmethods - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the GetInstanceProperties method without requiring authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface...

Call.com Setup Page - Exposure Detection

Detects exposed Call.com Setup page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed Call.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Call.com Setup Page - Exposure Detection', 'description': 'Detec...

Microsoft Exchange Web Service - Detect

Microsoft Exchange Web Services was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Web Services was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft Exchange We...

WordPress Simple File List <3.2.8 - Local File Inclusion Detection

WordPress Simple File List before 3.2.8 is vulnerable to local file inclusion via the eeFile parameter in the /includes/ee-downloader.php due to missing controls which make it possible for unauthenticated attackers retrieve arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage Detection

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty before 9.""" from kittysploit import from lib.protocols.http.httpclient import...

OAuth 2.0 Authorization Server Detection Template

Try to detect OAuth 2.0 Authorization Server via the "oauth/token" endpoint !/usr/bin/env python3 -- coding: utf-8 -- """Try to detect OAuth 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OAuth 2.0 Authorization...

ClickHouse API Database Interface - Improper Authorization Detection

Clickhouse API Database is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Clickhouse API Database is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ClickHouse API Database Interface - Improper...

Commvault CommCell - Local File Inclusion Detection

CommCell in Commvault before 14.68, 15.x before 15.58, 16.x before 16.44, 17.x before 17.29, and 18.x before 18.13 are vulnerable to local file inclusion because an attacker can view a log file can instead view a file outside of the log-files folder. !/usr/bin/env python3 -- coding: utf-8 --...

Jira Unauthenticated Admin Projects Detection

Detects Jira Unauthenticated Admin Projects. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jira Unauthenticated Admin Projects.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jira Unauthenticated Admin Projec...

Coremail - Config Discovery Detection

Coremail configuration information was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Coremail configuration information was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Coremail - Config...

F5 Next Central Manager Panel - Detect

F5 Next Central Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """F5 Next Central Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'F5 Next Central Manager...

User Role Editor - Full Path Disclosure Detection

User Role Editor WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """User Role Editor WordPres...

WordPress Coming Soon Page - Full Path Disclosure Detection

WordPress Coming Soon Page & Maintenance Mode plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Coming Soon Page & Maintenance Mode...

Allegro RomPager - Panel Detection

Allegro RomPager was detected.This toolkit was commonly used in embedded devices such as routers, cameras, and IoT devices, often on historical hardware with possible default credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Allegro RomPager was detected.""" from kittysploit import from...

OpenStack User Secrets Exposure Detection

Internal usersecrets.yml file is exposed in OpenStack. !/usr/bin/env python3 -- coding: utf-8 -- """Internal usersecrets.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenStack User Secrets Exposure Detection',...