HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass Detection

HPE Integrated Lights-out 4 iLO 4 prior to 2.53 was found to contain an authentication bypass and code execution vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """HPE Integrated Lights-out 4 iLO 4 prior to 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Apache Struts2 S2-053 - Remote Code Execution Detection

Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1 uses an unintentional expression in a Freemarker tag instead of string literals, which makes it susceptible to remote code execution attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re from kittysploit...

Apache Struts 2 - Remote Command Execution Detection

Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a...

Hikvision - Authentication Bypass Detection

Hikvision DS-2CD2xx2F-I Series V5.2.0 build 140721 to V5.4.0 build 160530, DS-2CD2xx0F-I Series V5.2.0 build 140721 to V5.4.0 Build 160401, DS-2CD2xx2FWD Series V5.3.1 build 150410 to V5.4.4 Build 161125, DS-2CD4x2xFWD Series V5.2.0 build 140721 to V5.4.0 Build 160414, DS-2CD4xx5 Series V5.2.0...

Cisco ASA - Local File Inclusion Detection

Cisco Adaptive Security Appliances ASA web interfaces could allow an unauthenticated, remote attacker to cause an affected device to reload unexpectedly, resulting in a denial of service DoS condition. It is also possible on certain software releases that the ASA will not reload, but an attacker...

Jenkins - Remote Command Injection Detection

Jenkins 2.153 and earlier and LTS 2.138.3 and earlier are susceptible to a remote command injection via stapler/core/src/main/java/org/kohsuke/stapler/MetaClass.java that allows attackers to invoke some methods on Java objects by accessing crafted URLs that were not intended to be invoked this wa...

Seagate NAS OS 4.3.15.1 - Server Information Disclosure Detection

Seagate NAS OS version 4.3.15.1 has insufficient access control which allows attackers to obtain information about the NAS without authentication via empty POST requests in /api/external/7.0/system.System.getinfos. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS OS version 4.""" from...

NUUO NVRmini - Remote Command Execution Detection

NUUO NVRmini is vulnerable to unauthenticated remote command execution through the upgradehandle.php file. The vulnerability allows an attacker to execute arbitrary commands by manipulating the uploaddir parameter. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini is vulnerable to...

FUEL CMS 1.4.1 - Remote Code Execution Detection

FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. !/usr/bin/env python3 -- coding: utf-8 -- """FUEL CMS 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info...

ThinkPHP 5.0.23 - Remote Code Execution Detection

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string. !/usr/bin/env python3 -- coding: utf-8 --...

Kibana - Local File Inclusion Detection

Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. An attacker with access to the Kibana Console API could send a request that will attempt to execute JavaScript which could possibly lead to an attacker executing arbitrary commands with...

TBK DVR4104/DVR4216 Devices - Authentication Bypass Detection

TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a "Cookie: uid=admin"...

Pulse Connect Secure SSL VPN Arbitrary File Read Detection

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. !/usr/bin/env python3 -- coding: utf...

Zeroshell 3.9.0 - Remote Command Execution Detection

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. !/usr/bin/env python3 -...

D-Link DNS-320 - Remote Code Execution Detection

The loginmgr.cgi script in D-Link DNS-320 through 2.05.B10 is vulnerable to remote command injection. !/usr/bin/env python3 -- coding: utf-8 -- """The loginmgr.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'D-Link...

vBulletin 5.0.0-5.5.4 - Remote Command Execution Detection

vBulletin 5.0.0 through 5.5.4 is susceptible to a remote command execution vulnerability via the widgetConfig parameter in an ajax/render/widgetphp routestring request. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system...

Citrix ADC and Gateway - Directory Traversal Detection

Citrix Application Delivery Controller ADC and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix Application Delivery Controller ADC and Gateway 10.""" from kittysploit import from...

Kibana Timelion - Arbitrary Code Execution Detection

Kibana versions before 5.6.15 and 6.6.1 contain an arbitrary code execution flaw in the Timelion visualizer. An attacker with access to the Timelion application could send a request that will attempt to execute javascript code. This could possibly lead to an attacker executing arbitrary commands...

UnRaid <=6.80 - Remote Code Execution Detection

UnRaid =6.80 allows remote unauthenticated attackers to execute arbitrary code. !/usr/bin/env python3 -- coding: utf-8 -- """UnRaid =6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UnRaid =6.80 - Remote Code...

Citrix ShareFile StorageZones <=5.10.x - Arbitrary File Read Detection

Citrix ShareFile StorageZones aka storage zones Controller versions through at least 5.10.x are susceptible to an unauthenticated arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix ShareFile StorageZones aka storage zones Controller versions through at least...

FortiWeb - Cross Site Scripting Detection

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. !/usr/bin/env python3 -- coding:...

YeaLink DM 3.6.0.20 - Remote Command Injection Detection

Yealink Device Management DM 3.6.0.20 allows command injection as root via the /sm/api/v1/firewall/zone/services URI, without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Yealink Device Management DM 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

ASUS GT-AC2900 - Authentication Bypass Detection

ASUS GT-AC2900 devices before 3.0.0.4.386.42643 allows authentication bypass when processing remote input from an unauthenticated user, leading to unauthorized access to the administrator application. This relates to handlerequest in router/httpd/httpd.c and authcheck in webhook.o. An...

Zyxel NBG2105 V1.00(AAGU.2)C0 - Authentication Bypass Detection

Zyxel NBG2105 V1.00AAGU.2C0 devices are susceptible to authentication bypass vulnerabilities because setting the login cookie to 1 provides administrator access. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel NBG2105 V1.""" from kittysploit import from lib.protocols.http.httpclient import...

Dahua IPC/VTH/VTO - Authentication Bypass Detection

Some Dahua products contain an authentication bypass during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. !/usr/bin/env python3 -- coding: utf-8 -- """Some Dahua products contain an authentication bypass during the login process."""...

Dahua IPC/VTH/VTO - Authentication Bypass Detection

The identity authentication bypass vulnerability found in some Dahua products during the login process. Attackers can bypass device identity authentication by constructing malicious data packets. !/usr/bin/env python3 -- coding: utf-8 -- """The identity authentication bypass vulnerability found i...

Cyberoam NetGenie Cross-Site Scripting Detection

Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected cross-site scripting via the 'u' parameter of ft.php. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberoam NetGenie C0101B1-20141120-NG11VO devices through 2021-08-14 are susceptible to reflected...

Visual Tools DVR VX16 4.2.28.0 - Unauthenticated OS Command Injection Detection

Visual Tools DVR VX16 4.2.28.0 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. !/usr/bin/env python3 -- coding: utf-8 -- """Visual Tools DVR VX16 4.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Ivanti EPM Cloud Services Appliance Code Injection Detection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPM Cloud Services Appliance C...

D-Link DAP-1620 - Local File Inclusion Detection

D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can lead to unauthorized internal files reading /etc/passwd and /etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can lead to...

Oracle E-Business Suite 12.2.3 -12.2.11 - Remote Code Execution Detection

Oracle E-Business Suite 12.2.3 through 12.2.11 is susceptible to remote code execution via the Oracle Web Applications Desktop Integrator product, Upload component. An attacker with HTTP network access can execute malware, obtain sensitive information, modify data, and/or gain full control over a...

Güralp MAN-EAM-0003 3.2.4 - XML External Entity (XXE) Detection

cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity XXE issue via XML file upload, which leads to local file disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """cgi-bin/xmlstatus.""" import re from kittysploit import from lib.protocols.http.httpclient...

Ivanti Endpoint Manager Mobile (EPMM) - Authentication Bypass Detection

Ivanti Endpoint Manager Mobile EPMM, formerly MobileIron Core, through 11.10 allows remote attackers to obtain PII, add an administrative account, and change the configuration because of an authentication bypass, as exploited in the wild in July 2023. A patch is available. !/usr/bin/env python3 -...

Citrix NetScaler ADC and NetScaler Gateway - Remote Code Execution Detection

critical unauthenticated remote code execution RCE vulnerability affecting Citrix ADC NetScaler ADC and Citrix Gateway appliances configured as a Gateway VPN virtual server, ICA Proxy, CVPN, RDP Proxy or AAA virtual server. Exploitation can lead to arbitrary code execution. !/usr/bin/env python3 ...

Intelbras Switch - Information Disclosure Detection

An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration. !/usr/bin/env python3 -- coding: utf-8 -- """An authentication bypass in Intelbra...

Juniper J-Web - Remote Code Execution Detection

A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands !/usr/bin/env python3 -- coding: utf-8 -- """A PHP External...

Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read Detection

The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. This bug is nearly identical to the Citrix Bleed...

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution Detection

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

TeamCity < 2023.11.4 - Authentication Bypass Detection

In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible !/usr/bin/env python3 -- coding: utf-8 -- """In JetBrains TeamCity before 2023.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

SolarWinds Web Help Desk < 12.8.3 - Insecure Deserialization Detection

SolarWinds Web Help Desk before version 12.8.3 contain a critical Java deserialization vulnerability that enables remote code execution. Attackers can exploit this flaw to execute arbitrary commands on the host machine. Initially reported as unauthenticated, SolarWinds was unable to reproduce...

Aquatronica Controller System <= 5.1.6 - Information Disclosure Detection

Aquatronica Controller System firmware 5.1.6 and earlier and web interface 2.0 and earlier contain an information disclosure vulnerability caused by unauthenticated access to tcp.php endpoint, letting remote attackers retrieve sensitive configuration data including plaintext credentials, exploit...

Fortinet FortiWeb - SQL Injection Detection

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests. !/usr/bin/env python3 -- coding: utf-8 -- """An improper...

MajorDoMo - Unauthenticated RCE Detection

MajorDoMo contains a remote code execution caused by an include order bug and lack of exit after redirect in admin panel's PHP console, letting unauthenticated attackers execute arbitrary PHP code via crafted GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """MajorDoMo contains a remote...

ChurchCRM - API Authentication Bypass via URL Injection Detection

ChurchCRM 7.1.0 contains an authentication bypass caused by improper API middleware URL handling in ChurchCRM/Slim/Middleware/AuthMiddleware.php, letting unauthenticated attackers access protected API endpoints, exploit requires crafted request URL with 'api/public !/usr/bin/env python3 -- coding...

XWiki - Cross-Site Scripting Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users are able to forge an URL with a payload allowing to inject Javascript in the page XSS. It's possible to exploit the restore template to perform a XSS, e.g. by using URL such as:...

Base64 Encoder/Decoder <= 0.9.2 - Cross-Site Scripting Detection

The Base64 Encoder/Decoder WordPress plugin through 0.9.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. !/usr/bin/env python3 -- coding: utf-8 -- """The...

Makefile - Exposure Detection

Detected Makefile configuration file was identified, which potentially exposed build process details, author information, and directory structure !/usr/bin/env python3 -- coding: utf-8 -- """Detected Makefile configuration file was identified, which potentially exposed build process details, auth...

Detect Private Key on STEM Audio Table

Private Key on STEM audio table was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Private Key on STEM audio table was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Private Key on STEM Audi...

Joomla! Component com_rokdownloads - Local File Inclusion Detection

A directory traversal vulnerability in the RokDownloads comrokdownloads component before 1.0.1 for Joomla! allows remote attackers to include and execute arbitrary local files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

NETGEAR Routers - Remote Code Execution Detection

NETGEAR routers R6250 before 1.0.4.6.Beta, R6400 before 1.0.1.18.Beta, R6700 before 1.0.1.14.Beta, R6900, R7000 before 1.0.7.6.Beta, R7100LG before 1.0.0.28.Beta, R7300DST before 1.0.0.46.Beta, R7900 before 1.0.1.8.Beta, R8000 before 1.0.3.26.Beta, D6220, D6400, D7000, and possibly others allow...