Flowise - NVIDIA NIM Endpoints Missing Authentication Detection

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

Progress ADC LoadMaster - Command Injection

Unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress ADC LoadMaster - Command Injection""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Fortinet FortiManager CVE-2024-47575 Detection

Detects FortiManager and probes FGFM TCP/541 for CVE-2024-47575 unauthenticated registration / fileexchange acceptance. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiManager CVE-2024-47575 FGFM missing auth detection.""" from kittysploit import from lib.protocols.http.httpclient impo...

Palo Alto GlobalProtect CVE-2024-3400 Detection

Detects CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect by confirming the SESSID path-traversal file-create canary 404 then 403. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect CVE-2024-3400 path traversal / RCE detection.""" import secrets from kittysploit import fr...

SAP NetWeaver CVE-2025-31324 Detection

Detects unauthenticated access to SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-31324 without uploading a malicious payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer CVE-2025-31324 unauth metadata uploader detection.""" from kittysploit import from...

application.yaml detection

Finds Application YAML files which often contain sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Finds Application YAML files which often contain sensitive information.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Laravel Passport - OAuth2 Keys Exposed Detection

Laravel Passport OAuth2 RSA private or public keys are publicly accessible at default storage paths. Exposed private keys allow attackers to forge OAuth2 access tokens and impersonate any user. !/usr/bin/env python3 -- coding: utf-8 -- """Laravel Passport OAuth2 RSA private or public keys are...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution Detection

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re from kittysploit import from...

Kyocera Printer d-COPIA253MF - Directory Traversal Detection

Kyocera Printer d-COPIA253MF plus is susceptible to a directory traversal vulnerability which could allow an attacker to retrieve or view arbitrary files from the affected server. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera Printer d-COPIA253MF plus is susceptible to a directory traversa...

NETGEAR - Authentication Bypass Detection

NETGEAR R6020, R6080, R6120, R6220, R6260, R6700v2, R6800, R6900v2, R7450, JNR3210, WNR2020, Nighthawk AC2100, and Nighthawk AC2400 routers are vulnerable to authentication bypass vulnerabilities which could allow network-adjacent attackers to bypass authentication on affected installations...

Zyxel NAS Firmware 5.21- Remote Code Execution Detection

Multiple Zyxel network-attached storage NAS devices running firmware version 5.21 contain a pre-authentication command injection vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable device. Zyxel NAS devices achieve authentication by using th...

VMware vSphere Client (HTML5) - Remote Code Execution Detection

VMware vCenter vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. Th...

VMware vSphere Client (HTML5) - Remote Code Execution Detection

The vSphere Client HTML5 contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in which is enabled by default in vCenter Server. A malicious actor with network access to port 443 may exploit this issue to execute commands with...

Grafana v8.x - Arbitrary File Read Detection

Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is /public/plugins/NAME/, where NAME is the plugin ID for any installed plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana versions 8."""...

D-Link DIR850 ET850-1.08TRb03 - Open Redirect Detection

DLink DIR850 ET850-1.08TRb03 contains incorrect access control vulnerability in URL redirection, which can be used to mislead users to go to untrusted sites. !/usr/bin/env python3 -- coding: utf-8 -- """DLink DIR850 ET850-1.""" import re from kittysploit import from lib.protocols.http.httpclient...

Sophos Firewall <=18.5 MR3 - Remote Code Execution Detection

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall version v18.""" from kittysploit import from...

TerraMaster TOS < 4.2.30 Server Information Disclosure Detection

TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster NAS devices running TOS prior to version 4.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

WAVLINK WN579 X3 M79X3.V5030.180719 - Information Disclosure Detection

WAVLINK WN579 X3 M79X3.V5030.180719 is susceptible to information disclosure in /cgi-bin/ExportAllSettings.sh. An attacker can obtain sensitive router information via a crafted POST request and thereby possibly obtain additional sensitive information, modify data, and/or execute unauthorized...

Tenda AC1200 V-W15Ev2 - Authentication Bypass Detection

The Tenda AC1200 V-W15Ev2 router is affected by improper authorization/improper session management. The software does not perform or incorrectly perform an authorization check when a user attempts to access a resource or perform an action. This allows the router's login page to be bypassed. The...

MobileIron Core - Remote Unauthenticated API Access Detection

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, Since CVE-2023-35082 arises from the same place as CVE-2023-35078, specifically the permissive nature of certain entries in the mifs web application’s security filter chain. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Endpoint...

TOTOLINK A3700R - Command Injection Detection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in TOTOLINK A3700R v.""" import re from kittysploit import from...

Linksys E2000 1.0.06 position.js Improper Authentication Detection

Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E2000 Ver.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Linksy...

Zyxel NAS326 Firmware < V5.21(AAZF.17)C0 - NsaRescueAngel Backdoor Account Detection

The command injection vulnerability in the CGI program "remotehelp-cgi" in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted HTTP POST...

Brother MFC-L9570CDW - Information Disclosure Detection

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...

Ivanti Cloud Services Appliance - Path Traversal Detection

Path Traversal in the Ivanti CSA before 4.6 Patch 519 allows a remote unauthenticated attacker to access restricted functionality. !/usr/bin/env python3 -- coding: utf-8 -- """Path Traversal in the Ivanti CSA before 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

TVT DVR Sensitive Device - Information Disclosure Detection

A vulnerability has been found in TVT DVR TD-2104TS-CL, DVR TD-2108TS-HP, Provision-ISR DVR SH-4050A5-5LMM and AVISION DVR AV108T and classified as problematic. This vulnerability affects unknown code of the file /queryDevInfo. The manipulation leads to information disclosure. !/usr/bin/env pytho...

CKAN DataStore SQL Search - SQL Injection Detection

CKAN, an open-source data management system used for powering open data portals, contains an unauthenticated SQL injection vulnerability in the datastoresearchsql API endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """CKAN, an open-source data management system used for powering open data...

phpVMS < 7.0.6 - Legacy Importer Authorization Bypass Detection

phpVMS 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """phpVMS 7.""" from kittysploit import...

Spring Boot H2 Database - Remote Command Execution Detection

Spring Boot H2 Database is susceptible to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot H2 Database is susceptible to remote code execution.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

apache-axis-detect

Axis and Axis2 detection !/usr/bin/env python3 -- coding: utf-8 -- """Axis and Axis2 detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'apache-axis-detect', 'description': 'Axis and Axis2 detection', 'author'...

Yaws 1.91 - Local File Inclusion Detection

Yaws 1.91 allows unauthenticated local file inclusion via /%5C../ submitted to port 8080. !/usr/bin/env python3 -- coding: utf-8 -- """Yaws 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Yaws 1.91 - Local File...

Fronsetiav1.1 - Cross-Site Scripting Detection

The fronsetiav1.1 application is vulnerable to a Reflected XSS attack through the showoperations.jsp endpoint. An attacker can inject malicious scripts via the WSDL Location input, which is executed in the victim's browser due to improper input sanitization. This allows attackers to execute...

Reflected XSS Detection

Reflected cross-site scripting vulnerability was discovered via generic testing. Manual testing is needed to verify exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Reflected cross-site scripting vulnerability was discovered via generic testing.""" from kittysploit import from...

Ivanti Connect Secure CVE-2024-21887 Detection

Detects the CVE-2023-46805 auth-bypass path that enables CVE-2024-21887 command injection by reading restricted JSON APIs without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure CVE-2024-21887 surface via CVE-2023-46805 auth bypass.""" from kittysploit import fr...

XWiki < 14.10.14 - Cross-Site Scripting Detection

XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the...

Generic Database File - Exposure Detection

This is collection of some web frameworks recommendation or default configuration for SQLite database file location. If this file is publicly accessible due to server misconfiguration, it could result in application data leak including users sensitive data, password hashes etc. !/usr/bin/env...

Ruby Gem::ConfigFile Credential - Exposure Detection

Ruby Gem credentials file is exposed, potentially leaking RubyGems API keys. The /.gem/credentials file stores authentication tokens for publishing gems to RubyGems.org or private gem servers. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby Gem credentials file is exposed, potentially leaking...

Wordpress Git Config Detection

Searches for the pattern /.git/config inside themes and plugins folder. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for the pattern /.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress Git Config...

Synology Web Station Page - Detect

Synology Web Station page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Web Station page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Synology Web Station Page - Detect',...

Digital Rebar - Local File Inclusion Detection

Digital Rebar versions 4.3.0, 4.3.2, 4.3.3, 4.4.0, and maybe others are vulnerable to local file inclusion because web requests can navigate outside of DRP controlled areas. !/usr/bin/env python3 -- coding: utf-8 -- """Digital Rebar versions 4.""" import re from kittysploit import from...

EvilGinx - Detect

Evilginx2 is a man-in-the-middle attack framework used for phishing login credentials along with session cookies which in turn allows bypassing 2-factor authentication protection. !/usr/bin/env python3 -- coding: utf-8 -- """Evilginx2 is a man-in-the-middle attack framework used for phishing logi...

kkFileView 4.1.0 - Cross-Site Scripting Detection

kkFileView 4.1.0 contains multiple cross-site scripting vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java. !/usr/bin/env python3 -- coding: utf-8 -- """kkFileView 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Neocase HR Portal Login Panel - Detect

Neocase HR Portal login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Neocase HR Portal login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Neocase HR Portal Login Panel -...

Prestashop Installer Exposure Detection

Prestashop is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Prestashop is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Ampache Music Installer Detection

Ampache Music is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Ampache Music is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

Matomo Installer Exposure Detection

Matomo is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Matomo is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Pandora FMS Installation Page - Exposure Detection

Detects exposed Pandora FMS installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed Pandora FMS installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pandora FMS Installation Page...

Lychee Installer Detection

Lychee is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Lychee is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Espocrm Installer Detection

Espocrm is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Espocrm is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Alma Installation Exposure Detection

Alma is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Alma is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...