Zimbra Panel - Detect

Zimbra panel was detected. Zimbra provides open source server and client software for messaging and collaboration. !/usr/bin/env python3 -- coding: utf-8 -- """Zimbra panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

Joomla! Component Jphone 1.0 Alpha 3 - Local File Inclusion Detection

A directory traversal vulnerability in jphone.php in the JPhone comjphone component 1.0 Alpha 3 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

emlog 5.3.1 Path Disclosure Detection

emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file. !/usr/bin/env python3 -- coding: utf-8 -- """emlog v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

PKP Open Journal Systems 2.4.8-3.3 - Cross-Site Scripting Detection

PKP Open Journal Systems 2.4.8 to 3.3 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary code via the X-Forwarded-Host Header. !/usr/bin/env python3 -- coding: utf-8 -- """PKP Open Journal Systems 2.""" from kittysploit import from...

Apollo Admin Service - Unauthenticated Access Detection

ApolloAdminservice was able to be accessed without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """ApolloAdminservice was able to be accessed without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

Huiwen library bibliographic Retrieval System - Information Exposure Detection

Huiwen library bibliographic retrieval system /include/config.properties file contains sensitive information, attackers can directly access to obtain information !/usr/bin/env python3 -- coding: utf-8 -- """Huiwen library bibliographic retrieval system /include/config.""" from kittysploit import...

Ecology - Local File Inclusion Detection

Ecology is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Ecology is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ecology - Local File Inclusio...

4D Detection

4D technology was detected. !/usr/bin/env python3 -- coding: utf-8 -- """4D technology was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': '4D Detection', 'description': '4D technology was detected.',...

Oauth Credentials Json Detection

Oauth Credentials file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Oauth Credentials file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oauth Credentials Json Detection', 'description':...

Eyou E-Mail <3.6 - Remote Code Execution Detection

Eyou Mail System before 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter to admin/domain/iploginset/diploginget.php via the getloginipconfigfile function. !/usr/bin/env python3 -- coding: utf-8 -- """Eyou Mail System before 3.""" import re...

Server Backup Manager SE Panel - Detect

Server Backup Manager SE login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Server Backup Manager SE login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Server Back...

Leostream Login Panel - Detect

Leostream login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Leostream login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Leostream Login Panel - Detect', 'description':...

Versa Concerto Actuator Endpoint - Authentication Bypass Detection

An authentication bypass vulnerability affected the Spring Boot Actuator endpoints in Versa Concerto due to improper handling of the X-Real-Ip header.Attackers could access restricted endpoints by omitting this header.The issue allowed unauthorized access to sensitive functionality, highlighting...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the errorMsg parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and...

Joomla! Component simpledownload <=0.9.5 - Arbitrary File Retrieval Detection

A directory traversal vulnerability in the SimpleDownload comsimpledownload component before 0.9.6 for Joomla! allows remote attackers to retrieve arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal...

OpenEMR < 7.0.1 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository openemr/openemr prior to 7.""" from kittysploit import from lib.protocols.http.httpclient import...

Joomla! Component com_cartweberp - Local File Inclusion Detection

A directory traversal vulnerability in the CARTwebERP comcartweberp component 1.56.75 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in the...

Atlassian Bamboo Setup Wizard Detection

Atlassian Bamboo is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Atlassian Bamboo is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

Webalizer Log Analyzer Configuration - Detect

Webalizer log analyzer configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Webalizer log analyzer configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Webalizer Log Analyze...

Nginx Dashboard Detection

Nginx Dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx Dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Dashboard Detection', 'description': 'Nginx Dashboard is...

Honeywell PM43 Printers - Command Injection Detection

Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM Printer web page modules allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 e.g. P10.19.050006...

ZOHO ManageEngine ADSelfService Plus - Detect

ZOHO ManageEngine ADSelfService panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ZOHO ManageEngine ADSelfService panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ZOHO ManageEngine...

Nexus Repository Manager - Anonymous Access Enabled Detection

Detected Nexus Repository Manager instance with anonymous access enabled, allowing unauthenticated users to list and browse repositories containing private artifacts including source code, packages, and Docker images. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Nexus Repository Manager...

SPIP Install - Exposure Detection

SPIP is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """SPIP is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

XSS-Protection Header - Cross-Site Scripting Detection

Setting the XSS-Protection header is deprecated. Setting the header to anything other than 0 can actually introduce an XSS vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Setting the XSS-Protection header is deprecated.""" import re from kittysploit import from...

WordPress Ninja Job Board < 1.3.3 - Direct Request Detection

WordPress Ninja Job Board plugin prior to 1.3.3 is susceptible to a direct request vulnerability. The plugin does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated directory listing which allows the download of uploaded resumes. !/usr/bin/env...

Gitea Installer Exposure Detection

Gitea is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Gitea is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

D-Link Network Attached Storage - Backdoor Account Detection

A vulnerability, which was classified as very critical, has been found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. This issue affects some unknown processing of the file /cgi-bin/nassharing.cgi of the component HTTP GET Request Handler. The manipulation of the argument user...

WordPress S3 Video <=0.983 - Cross-Site Scripting Detection

WordPress S3 Video and before contains a reflected cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials...

Winstone Servlet Engine Detection

Detected servers running the Winstone Servlet Engine via the Server or X-Powered-By headers. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers running the Winstone Servlet Engine via the Server or X-Powered-By headers.""" import re from kittysploit import from...

Ncomputing vSPace Pro 10 and 11 - Directory Traversal Detection

Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import...

Zend Server <9.13 - Cross-Site Scripting Detection

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zend Server before version 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Mezzanine CMS - Detect

Detects instances of Mezzanine CMS based on unique fingerprints and identifiers. !/usr/bin/env python3 -- coding: utf-8 -- """Detects instances of Mezzanine CMS based on unique fingerprints and identifiers.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Verizon Router Panel - Detect

Verizon router panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Verizon router panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Verizon Router Panel - Detect', 'description': 'Veriz...

Jeedom <=4.0.38 - Cross-Site Scripting Detection

Jeedom through 4.0.38 contains a cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """Jeedom through 4.""" from kittysploit import from...

nPerf Server - Detect

A nperf panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A nperf panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'nPerf Server - Detect', 'description': 'A nperf panel was detected....

Joomla! Component PowerMail Pro 1.5.3 - Local File Inclusion Detection

A directory traversal vulnerability in the givesight PowerMail Pro compowermail component 1.5.3 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8...

Atlassian Confluence End-of-Life - Detect

Detected Atlassian Confluence instances versions that have reached End-of-Life EOL and no longer receive security updates. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Atlassian Confluence instances versions that have reached End-of-Life EOL and no longer receive sec.""" import re from...

Lucee - Unset Credentials Detection

The Lucee admin panel has a first-time setup page which allows any user to set the administrator password. !/usr/bin/env python3 -- coding: utf-8 -- """The Lucee admin panel has a first-time setup page which allows any user to set the administrator password.""" from kittysploit import from...

Endpoint Protector Login Panel - Detect

Endpoint Protector - Reporting and Administration Tool login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Endpoint Protector - Reporting and Administration Tool login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Plugin Really Simple CAPTCHA - Full Path Disclosure Detection

WordPress Plugin Really Simple CAPTCHA was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin...

Cacti - Full Path Disclosure Detection

Detected a Full Path Disclosure FPD in Cacti when the log file is not writable. The error message reveals the absolute path of the log file on the server. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a Full Path Disclosure FPD in Cacti when the log file is not writable.""" import re from...

WebcamXP 5 Login Panel - Detect

WebcamXP 5 login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WebcamXP 5 login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebcamXP 5 Login Panel - Detect', 'description':...

Seeyon A8 Management Monitor - Default Login Detection

Seeyon OA A8-m has status monitoring page information leakage. Attackers can obtain sensitive information such as website paths and user names for further attacks. Attackers can use this vulnerability to directly enter the application system or management system to conduct system, web page, data...

GL.iNET SSID Key Disclosure Detection

An issue was discovered on GL.iNet devices before 3.216. An API endpoint reveals information about the Wi-Fi configuration, including the SSID and key. !/usr/bin/env python3 -- coding: utf-8 -- """An issue was discovered on GL.""" from kittysploit import from lib.protocols.http.httpclient import...

Eleanor CMS - Open Redirect Detection

Open redirect vulnerability in go.php in Eleanor CMS allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the QUERYSTRING. !/usr/bin/env python3 -- coding: utf-8 -- """Open redirect vulnerability in go.""" import re from kittysploit import fro...

WHM Login Panel - Detect

WHM login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WHM login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WHM Login Panel - Detect', 'description': 'WHM login panel was...

Apache2 Default Test Page Detection

Detects Apache2 Default Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache2 Default Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache2 Default Test Page Detection', 'description':...

Copyparty <= 1.8.2 - Directory Traversal Detection

Copyparty is a portable file server. Versions prior to 1.8.2 are subject to a path traversal vulnerability detected in the .cpr subfolder. The Path Traversal attack technique allows an attacker access to files, directories, and commands that reside outside the web document root directory. This...

AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting Detection

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sa."""...