QCube Cross-Site-Scripting Detection

A reflected cross-site scripting vulnerability in qcubed all versions including 3.1.1 in profile.php via the stQuery-parameter allows unauthenticated attackers to steal sessions of authenticated users. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in...

Social Metrics Tracker <= 1.6.8 - Unauthorised Data Export Detection

The lack of proper authorisation when exporting data from the plugin could allow unauthenticated users to get information about the posts and page of the blog, including their author's username and email. !/usr/bin/env python3 -- coding: utf-8 -- """The lack of proper authorisation when exporting...

Publicly accessible NPM Log file Detection

NPM log file is exposed to external users. !/usr/bin/env python3 -- coding: utf-8 -- """NPM log file is exposed to external users.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Publicly accessible NPM Log file...

Krpano Panorama Viewer - Detection

Detected Krpano Panorama Viewer by identifying known Krpano-specific resources and response patterns. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Krpano Panorama Viewer by identifying known Krpano-specific resources and response patterns.""" from kittysploit import from...

Talroo Jobs Script 1.0 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

CMSimple 3.1 - Local File Inclusion Detection

CMSimple 3.1 is susceptible to local file inclusion via cmsimple/cms.php when registerglobals is enabled which allows remote attackers to include and execute arbitrary local files via a .. dot dot in the sl parameter to index.php. NOTE: this can be leveraged for remote file execution by including...

Symfony FOSJsRoutingBundle Detection

Detects Symfony FOSJsRoutingBundle. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Symfony FOSJsRoutingBundle.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Symfony FOSJsRoutingBundle Detection', 'description...

Synology Web Station Page - Detect

Synology Web Station page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Synology Web Station page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Synology Web Station Page - Detect',...

Wordpress Git Config Detection

Searches for the pattern /.git/config inside themes and plugins folder. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for the pattern /.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress Git Config...

AWS Cloudfront service detection

Detect websites using AWS cloudfront service !/usr/bin/env python3 -- coding: utf-8 -- """Detect websites using AWS cloudfront service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Cloudfront service detection...

EVSE Web Interface Panel - Detection

Detects EVSE Web Interface Panel - Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EVSE Web Interface Panel - Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EVSE Web Interface Panel -...

WordPress Guppy <=1.1 - Information Disclosure Detection

WordPress Guppy plugin through 1.1 is susceptible to an API disclosure vulnerability. This can allow an attacker to obtain all user IDs and then use them to make API requests to get messages sent between users and/or send messages posing as one user to another. !/usr/bin/env python3 -- coding:...

GnuBoard5 5.5.16 - Open Redirect Detection

Gnuboard5 5.5.16 contains an open redirect vulnerability caused by insufficient URL parameter verification in bbs/logout.php, letting remote attackers redirect users to arbitrary URLs, exploit requires crafted URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard5 5.""" import re...

Teampass LDAP Debug Config - Detect

Teampass ldap.debug.txt config was detected. This file is generated on "/files/ldap.debug.txt" for versions earlier than 3.0.0.0 when utilizing the "Test current configuration" in LDAP settings. !/usr/bin/env python3 -- coding: utf-8 -- """Teampass ldap.""" from kittysploit import from...

Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution Detection

critical unauthenticated remote code execution RCE vulnerability affecting Citrix ADC NetScaler ADC and Citrix Gateway appliances configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy or AAA virtual server. Exploitation can lead to arbitrary code execution. !/usr/bin/env python3 ...

Grafana v8.x - Arbitrary File Read Detection

Grafana versions 8.0.0-beta1 through 8.3.0 are vulnerable to a local directory traversal, allowing access to local files. The vulnerable URL path is /public/plugins/NAME/, where NAME is the plugin ID for any installed plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Grafana versions 8."""...

ifw8 Router ROM v4.31 - Credential Discovery Detection

ifw8 Router ROM v4.31 is vulnerable to credential disclosure via action/usermanager.htm HTML source code. !/usr/bin/env python3 -- coding: utf-8 -- """ifw8 Router ROM v4.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

Qualitor <= v8.24 - Server-Side Request Forgery Detection

Qualitor v8.24 was discovered to contain a Server-Side Request Forgery SSRF via the component /request/viewValidacao.php. !/usr/bin/env python3 -- coding: utf-8 -- """Qualitor v8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

Roundcube ≤ 1.6.10 Post-Auth RCE (CVE-2025-49113)

Authenticated RCE in Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11. Unsafe from handling in settings/upload.php allows PHP object deserialization via a CryptGPGEngine gadget command execution as the web server user. !/usr/bin/env python3 -- coding: utf-8 -- """Roundcube ≤ 1.6.10 post-au...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted ...

FortiRecorder Panel - Detect

FortiRecorder Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """FortiRecorder Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FortiRecorder Panel - Detect', 'description':...

CyberPower - SQL Injection Detection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. !/usr/bin/env python3 -- coding: utf-8 -- """A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.""" from kittysploit import from lib.protocols.http.httpclient import...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

Phpmyfaq v3.1.11 - Cross-Site Scripting Detection

Phpmyfaq v3.1.11 is vulnerable to reflected XSS in send2friend because the 'artlang' parameter is not sanitized. !/usr/bin/env python3 -- coding: utf-8 -- """Phpmyfaq v3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Wordpress RDF User Enumeration Detection

Leaked Wordpress RDF leads to User Emumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked Wordpress RDF leads to User Emumeration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpress RDF User...

Zzzcms 1.75 - Information Disclosure Detection

There is a rather strange file that directly echoes some content belonging to the inaccessible zzzconfig.php. The information leakage file is located in plugins\webuploader\js\webconfig.php, and the management path name of the management background can be obtained directly. No need to blast admin...

GeoServer - Missing Authorization on REST API Index Detection

GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer contains a missing authorization vulnerability that allows...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting Detection

A vulnerability was found in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, affecting the device description parameter in the web interface. This flaw allows stored cross-site scripting XSS, enabling attackers to inject JavaScript code. The attack can be executed remote...

VMware vSphere Client (HTML5) - Remote Code Execution Detection

VMware vCenter vSphere Client HTML5 contains a remote code execution vulnerability in a vCenter Server plugin. A malicious actor with network access to port 443 may exploit this issue to execute commands with unrestricted privileges on the underlying operating system that hosts vCenter Server. Th...

TerraMaster TOS < 4.2.30 Server Information Disclosure Detection

TerraMaster NAS devices running TOS prior to version 4.2.30 are vulnerable to information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """TerraMaster NAS devices running TOS prior to version 4.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Seeyon OA A6 initDataAssess.jsp - Information Disclosure Detection

Seeyon OA A6 initDataAssess.jsp has leaked user sensitive information, attacker can use the obtained username to blast the user's password to enter the background for further attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Seeyon OA A6 initDataAssess.""" from kittysploit import from...

UserGate NGFW/UTM Admin Panel - Detect

Detect UserGate NGFW/UTM Admin Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detect UserGate NGFW/UTM Admin Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UserGate NGFW/UTM Admin Panel - Detect',...

Apache Polaris - Information Disclosure Detection

Detects a Apache Polaris server, the interoperable, open source catalog for Apache Iceberg. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Polaris server, the interoperable, open source catalog for Apache Iceberg.""" from kittysploit import from lib.protocols.http.httpclient import...

WordPress Contact Form 7 - Full Path Disclosure Detection

The WordPress Contact Form 7 plugin was detected to be vulnerable to Full Path Disclosure, where direct access to PHP files revealed the full server filesystem path and could aid further exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Contact Form 7 plugin was detected to...

Apache Struts Dev Mode - Detect

Multiple Apache Struts applications were detected in dev-mode. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple Apache Struts applications were detected in dev-mode.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

WordPress Duplicator 1.3.24 & 1.3.26 - Local File Inclusion Detection

WordPress Duplicator 1.3.24 & 1.3.26 are vulnerable to local file inclusion vulnerabilities that could allow attackers to download arbitrary files, such as the wp-config.php file. According to the vendor, the vulnerability was only in two versions v1.3.24 and v1.3.26, the vulnerability wasn't...

WordPress Wordfence - Rules File Disclosure Detection

The Wordfence Security plugin for WordPress stores configuration files in the /wp-content/wflogs/ directory. These files may be accessible without authentication and can expose sensitive configuration data, firewall rules, attack logs, and internal paths. !/usr/bin/env python3 -- coding: utf-8 --...

Elastic Cloud API Key Detection

Detects Elastic Cloud API keys used for programmatic access to the Elastic Cloud and serverless APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Elastic Cloud API keys used for programmatic access to the Elastic Cloud and serverless APIs.""" import re from kittysploit import from...

Brother Printer Detection

Brother Printer unauthorized access was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Brother Printer unauthorized access was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Brother Printer...

SCIMono <0.0.19 - Remote Code Execution Detection

SCIMono before 0.0.19 is vulnerable to remote code execution because it is possible for an attacker to inject and execute java expressions and compromise the availability and integrity of the system. !/usr/bin/env python3 -- coding: utf-8 -- """SCIMono before 0.""" from kittysploit import from...

Spring Boot H2 Database - Remote Command Execution Detection

Spring Boot H2 Database is susceptible to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot H2 Database is susceptible to remote code execution.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

ForgeRock OpenAM <7.0 - Remote Code Execution Detection

ForgeRock AM server before 7.0 has a Java deserialization vulnerability in the jato.pageSession parameter on multiple pages. The exploitation does not require authentication, and remote code execution can be triggered by sending a single crafted /ccversion/ request to the server. The vulnerabilit...

mooDating 1.2 - Cross-site scripting Detection

A vulnerability was found in mooSocial mooDating 1.2. It has been classified as problematic. Affected is an unknown function of the file /matchmakings/question of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. VDB-235194 is...

Tomcat Stack Traces Enabled Detection

Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern. !/usr/bin/env python3 -- coding: utf-8 -- """Examine whether Tomcat stack traces are turned on by employing a designated problematic pattern.""" from kittysploit import from...

Juniper J-Web - Remote Code Execution Detection

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands !/usr/bin/env python3 -- coding: utf-8 -- """A PHP External...

Ivanti Connect Secure - Stack-based Buffer Overflow Detection

Ivanti Connect Secure 22.7R2.5, Ivanti Policy Secure 22.7R1.2, and Ivanti Neurons for ZTA gateways 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS...

Cacti Weathermap File Write Detection

Cacti Weathermap a plugin for Cacti, an open-source network monitoring and graphing tool is vulnerable to file write. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti Weathermap a plugin for Cacti, an open-source network monitoring and graphing tool is vulnerable to fi.""" from kittysploit impo...

Spring Boot AuditEvents Actuator Panel - Detect

Spring Boot Auditevents Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Auditevents Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spring Boot...

Wanhu OA OfficeServerServlet - Arbitrary File Upload Detection

Wanhu OA officeserverservlet file upload vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Wanhu OA officeserverservlet file upload vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wanhu OA...

GTranslate < 2.8.65 - Cross-Site Scripting Detection

In the Pro and Enterprise versions of GTranslate 2.8.65, the gtranslaterequesturivar function runs at the top of all pages and echoes out the contents of $SERVER'REQUESTURI'. Although this uses addslashes, and most modern browsers automatically URLencode requests, this plugin is still vulnerable ...