PAN-OS Management Interface - Path Confusion to Authentication Bypass Detection

A vulnerability in PAN-OS management interface allows authentication bypass through path confusion between Nginx and Apache handlers.The issue occurs due to differences in path processing between Nginx and Apache, where double URL encoding combined with directory traversal can bypass authenticati...

Fides Privacy Center ≤ 2.39.1 - Server-Side URL Disclosure Detection

Fides versions 2.19.0 to before 2.39.2rc0 contain an information disclosure caused by unauthenticated HTTP GET request to the Privacy Center, letting attackers access the SERVERSIDEFIDESAPIURL, which may reveal server configuration details, exploit requires no authentication. !/usr/bin/env python...

InfluxDB <1.7.6 - Authentication Bypass Detection

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret aka shared secret. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

Apache HTTP server v2.4.0 to v2.4.39 - Open Redirect Detection

In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with modrewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. !/usr/bin/env python3 -- coding: utf-8 -- """In Apache HTTP server 2.""" impo...

WordPress Core <=6.2 - Directory Traversal Detection

WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wplang’ parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.""" from kittysploit import from...

HotelDruid 2.3.0 - Cross-Site Scripting Detection

HotelDruid 2.3.0 contains a cross-site scripting vulnerability affecting nsextt, cambia1, mesefine, origine, and anno parameters in creaprezzi.php, tabella3.php, personalizza.php, and visualizzatabelle.php. !/usr/bin/env python3 -- coding: utf-8 -- """HotelDruid 2.""" from kittysploit import from...

Debug Endpoint pprof - Exposure Detection

The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. This debugging endpoint can potentially leak sensitive information such as internal Kubelet memory addresses and configuration, or for limited denial of service. Versions prior to 1.15.0, 1.14.4, 1.13.8,...

Open Redirect in Host Authorization Middleware Detection

Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. !/usr/bin/env python3 -- coding: utf-8 -- """Specially crafted "X-Forwarded-Host" headers in...

Apache Struts 2 - Remote Command Execution Detection

Apache Struts 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 is susceptible to remote command injection attacks. The Jakarta Multipart parser has incorrect exception handling and error-message generation during file upload attempts, which can allow an attacker to execute arbitrary commands via a...

Casdoor - Authorization Bypass Detection

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. !/usr/bin/env python3 -- coding: utf-8 -- """Casdoor up to 1.""" from kittysploit import from...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal Detection

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. !/usr/bin/env python3 -- coding: utf-8 -- """TRUfusion Enterprise versions...

Cacti - Cross-Site Scripting Detection

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti contains a cross-site scripting vulnerability via...

VMware vRealize Log Insight - Improper Access Control to RCE Detection

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """The vRealize Log Insight...

Twonky Server 8.5.2 on Linux and Windows - Log File Exposure Detection

Twonky Server 8.5.2 contains a broken access control vulnerability caused by bypassing web service API authentication, letting unauthenticated attackers read log files with administrator credentials, exploit requires no authentication !/usr/bin/env python3 -- coding: utf-8 -- """Twonky Server 8."...

Prometheus - Open Redirect Detection

Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and...

SPIP Porte Plume Plugin - Remote Code Execution Detection

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """Th...

LearnDash LMS < 4.10.3 - Sensitive Information Exposure Detection

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions. !/usr/bin/env python3 -- coding: utf-8 -- """The LearnDash LMS plug...

MeteoBridge <= 6.1 - Remote Code Execution Detection

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

Roundcube CVE-2025-49113 Detection

Fingerprints Roundcube via rcversion and flags builds before 1.5.10 / 1.6.x before 1.6.11 as vulnerable to post-auth PHP deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Roundcube versions vulnerable to CVE-2025-49113.""" from kittysploit import from...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts Detection

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress before 5.""" import re from kittysploit impo...

CentreStack Login Panel - Detect

Gladinet CentreStack login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gladinet CentreStack login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CentreStack Login Panel -...

Adminer <=4.8.0 - Cross-Site Scripting Detection

Adminer 4.6.1 to 4.8.0 contains a cross-site scripting vulnerability which affects users of MySQL, MariaDB, PgSQL, and SQLite in browsers without CSP when Adminer uses a pdo extension to communicate with the database it is used if the native extensions are not enabled. !/usr/bin/env python3 --...

Ellucian Ethos Identity CAS - Cross-Site Scripting Detection

A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. !/usr/bin/env python...

Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read Detection

The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. This bug is nearly identical to the Citrix Bleed...

WordPress gtranslate Plugin Directory Listing Detection

Searches for sensitive directories present in the gtranslate wordpress plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the gtranslate wordpress plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hestia Control Panel Login - Detect

Hestia Control Panel login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hestia Control Panel login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hestia Control Panel Login - Detect',...

CS-Cart - Local File Inclusion Detection

CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers to access locally stored files and reveal their content. !/usr/bin/env python3 -- coding: utf-8 -- """CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers t...

Accept Donations with PayPal <= 1.5.2 - Open Redirect Detection

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

Oracle WebCenter Sites Detection

Detects Oracle WebCenter Sites. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle WebCenter Sites.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle WebCenter Sites Detection', 'description': 'Detects...

SeaweedFS Filer - Unauthenticated Access Detection

SeaweedFS Filer interface is exposed without authentication.Unauthenticated users may be able to upload, modify, or access files, potentially leading to malicious file hosting, data exposure, or remote compromise. !/usr/bin/env python3 -- coding: utf-8 -- """SeaweedFS Filer interface is exposed...

DD-WRT Control Panel - Exposure Detection

The DD-WRT web interface was found exposed without proper access controls, potentially allowing unauthorized users to view. !/usr/bin/env python3 -- coding: utf-8 -- """The DD-WRT web interface was found exposed without proper access controls, potentially allowing unauthorized u.""" from...

Sophos Firewall <=18.5 MR3 - Remote Code Execution Detection

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall version v18.""" from kittysploit import from...

bloofoxCMS Login Panel - Detect

Detects bloofoxCMS Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects bloofoxCMS Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'bloofoxCMS Login Panel - Detect',...

Dolphin Installer - Exposure Detection

Dolphin is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Dolphin is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Danswer Panel - Detect

Danswer panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Danswer panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Danswer Panel - Detect', 'description': 'Danswer panel was...

Axigen Mail Server Filename Directory Traversal Detection

Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. dot dot in the fileName parameter in a download action to source/loggin/pagelogdwnfile.hsp, or the fileName parameter in an edi...

SMF Installer Detection

SMF is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """SMF is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Magmi 0.7.22 - Cross-Site Scripting Detection

Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data prefix passed to the magmi-git-master/magmi/web/ajaxgettime.php URL. !/usr/bin/env python3 -- coding: utf-8 -- """Magmi 0.""" from kittysploit import from lib.protocols.http.httpclient...

Visual Studio Code Settings - Credential Exposure Detection

Detected exposed Visual Studio Code configuration files that were accessible over HTTP, which could have led to credential leakage or sensitive workspace disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Visual Studio Code configuration files that were accessible over HTTP...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability...

WordPress Oxygen-Theme - Local File Inclusion Detection

WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.""" from kittysploit import from...

WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal Detection

A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the dewfile parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in...

ZenML ZenML Server - Improper Authentication Detection

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. !/usr/bin/env python3 --...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS Detection

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Adminer = 5.""" from kittysploit impo...

WordPress UpdraftPlus - Full Path Disclosure Detection

WordPress Plugin UpdraftPlus files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin UpdraftPlus files are publicly accessible without...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage Detection

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. !/usr/bin/env python3 -- coding: utf-8 -- """Eclipse Jetty before 9.""" from kittysploit import from lib.protocols.http.httpclient import...

Dify Panel Detection

Detects Dify LLM application platform panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Dify LLM platform panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Dify Panel Detection", "description": "Detect...

WordPress Contact Form 7 - Full Path Disclosure Detection

The WordPress Contact Form 7 plugin was detected to be vulnerable to Full Path Disclosure, where direct access to PHP files revealed the full server filesystem path and could aid further exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Contact Form 7 plugin was detected to...

Eclipse Jetty ConcatServlet - Information Disclosure Detection

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

Prestashop Installer Exposure Detection

Prestashop is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Prestashop is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...