PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting Detection

A vulnerability was found in PHP Jabbers Night Club Booking Software 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack may be initiated remotely. The identifier...

OrangeHrm Installer Detection

OrangeHrm is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """OrangeHrm is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

WordPress Narnoo Distributor <=2.5.1 - Local File Inclusion Detection

WordPress Narnoo Distributor plugin 2.5.1 and prior is susceptible to local file inclusion. The plugin does not validate and sanitize the libpath parameter before being passed into a call to require via the narnoodistributorlibrequest AJAX action, and the content of the file is displayed in the...

Druid Monitor Login Panel - Detect

Druid Monitor login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Druid Monitor login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Druid Monitor Login Panel - Detect',...

Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting Detection

Triconsole Datepicker Calendar before 3.77 contains a cross-site scripting vulnerability in calendarform.php. Attackers can read authentication cookies that are still active, which can be used to perform further attacks such as reading browser history, directory listings, and file contents...

Moxa MXview One - Network Management Panel Detection

Moxa MXview One is a network management platform for industrial Ethernet infrastructure, OT network monitoring, and topology visualisation. It is widely used in manufacturing, energy, and transportation to manage industrial switches and routers. !/usr/bin/env python3 -- coding: utf-8 -- """Moxa...

Tomcat Exposed - Detect

An Apache Tomcat instance was detected. !/usr/bin/env python3 -- coding: utf-8 -- """An Apache Tomcat instance was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tomcat Exposed - Detect', 'description': 'A...

Jeesns 1.4.2 - Cross-Site Scripting Detection

Jeesns 1.4.2 is vulnerable to reflected cross-site scripting in the /weibo/topic component and allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the system error message's text field. !/usr/bin/env python3 -- coding: utf-8 -- """Jeesns 1.""" from kittysploit impor...

PHP-Fusion 9.03.50 - Remote Code Execution Detection

PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user not admin to send a crafted request to the server and perform remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """PHP-Fusion 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Citrix XenMobile Server - Local File Inclusion Detection

Citrix XenMobile Server 10.12 before RP2, Citrix XenMobile Server 10.11 before RP4, Citrix XenMobile Server 10.10 before RP6, and Citrix XenMobile Server before 10.9 RP5 are susceptible to local file inclusion vulnerabilities. reference: -...

Blue Ocean Excellence - Local File Inclusion Detection

Blue Ocean Excellence is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Blue Ocean Excellence is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Freshrss Panel - Detect

Freshrss panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """Freshrss panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Freshrss Panel - Detect', 'description': 'Freshrss pane...

Jupyter Lab - Unauthenticated Access Detection

JupyterLab was able to be accessed without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JupyterLab was able to be accessed without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jupyt...

MicroStrategy Web 10.4 - Information Disclosure Detection

MicroStrategy Web 10.4 is susceptible to information disclosure. The JVM configuration, CPU architecture, installation folder, and other information are exposed through /MicroStrategyWS/happyaxis.jsp. An attacker can use this vulnerability to learn more about the application environment and there...

Django RasterField - SQL Injection Detection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. !/usr/bin/env python3 -- coding: utf-8 -- """Django 6.""" from kittysploit import...

Tensorflow Tensorboard - Unauthenticated Access Detection

Tensorflow Tensorboard was able to be accessed with no authentication requirements in place. !/usr/bin/env python3 -- coding: utf-8 -- """Tensorflow Tensorboard was able to be accessed with no authentication requirements in place.""" from kittysploit import from lib.protocols.http.httpclient impo...

Hashicorp Consul API Unauthenticated Detection

In HashiCorp Consul's API without authentication arises when Consul is improperly secured, exposing its endpoints to unauthorized access. !/usr/bin/env python3 -- coding: utf-8 -- """In HashiCorp Consul's API without authentication arises when Consul is improperly secured, exposing its endpoi."""...

mooDating 1.2 - Cross-site scripting Detection

A vulnerability, which was classified as problematic, was found in mooSocial mooDating 1.2. Affected is an unknown function of the file /find-a-match of the component URL Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. !/usr/bin/env python3 -...

Modoboa Login Panel - Detect

Modoboa login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Modoboa login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Modoboa Login Panel - Detect', 'description': 'Modoboa...

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion Detection

WordPress 99 Robots WP Background Takeover Advertisements 4.1.4 is susceptible to local file inclusion via exports/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress 99 Robots WP Background Takeover Advertisements 4.""" from kittysploit import from lib.protocols.http.httpclient...

Adobe AEM CRX Package Manager - Panel Detect

Adobe AEM CRX Package Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM CRX Package Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Package...

Zhiyuan Oa Unauthorized Detection

Zhiyuan Oa is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Zhiyuan Oa is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zhiyuan Oa Unauthorized Detection', 'description': 'Zhiyuan Oa is exposed.',...

PayloadCMS - Detect

PayloadCMS panel was detected. PayloadCMS is an open-source, headless CMS and application framework built with Node.js, React, and TypeScript. !/usr/bin/env python3 -- coding: utf-8 -- """PayloadCMS panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclien...

Jalios JCMS Login Panel - Detect

Jalios JCMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jalios JCMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jalios JCMS Login Panel - Detect', 'description...

DevExpress - Detect

Detect DevExpress based on the existence of its HTTP handler for serving images, scripts, and other resources to the client side. !/usr/bin/env python3 -- coding: utf-8 -- """Detect DevExpress based on the existence of its HTTP handler for serving images, scripts, and other resources .""" from...

XWiki WYSIWYG API - Open Redirect Detection

A vulnerability in XWiki's WYSIWYG API allows an attacker to redirect users to arbitrary external URLs through the xerror parameter. This could be used in phishing attacks to redirect users to malicious websites. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in XWiki's WYSIWYG API...

IceWarp Login Panel - Detect

IceWarp login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp Login Panel - Detect', 'description': 'IceWarp...

apache-axis-detect

Axis and Axis2 detection !/usr/bin/env python3 -- coding: utf-8 -- """Axis and Axis2 detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'apache-axis-detect', 'description': 'Axis and Axis2 detection', 'author'...

ServiceNow Login Panel - Detect

ServiceNow Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ServiceNow Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ServiceNow Login Panel - Detect', 'description':...

Stormshield Network Security - Login Panel Detection

Stormshield Network Security SNS is a French network security appliance providing firewall, IPS, VPN, and web filtering capabilities. Its web management portal is frequently exposed on non-standard ports. !/usr/bin/env python3 -- coding: utf-8 -- """Stormshield Network Security SNS is a French...

ExpressionEngine Exception - Page Detection

Detects ExpressionEngine Exception - Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ExpressionEngine Exception - Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ExpressionEngine Exception - Page...

Cacti Log - Exposure Detection

Exposed Cacti log files cacti.log were detected. These files contain system statistics, error messages, and potentially sensitive information. They can also be used in log poisoning attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Cacti log files cacti.""" import re from kittysploit...

Vue PACS - Panel Detection

Vue PACS was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Vue PACS was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Vue PACS - Panel Detection', 'description': 'Vue PACS was detected.', 'author...

Easy FancyBox - Full Path Disclosure Detection

Easy FancyBox WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Easy FancyBox WordPress plug...

LobeHub LobeChat <= 2.1.56 - Server-Side Request Forgery Detection

LobeHub LobeChat versions up to and including 2.1.56 are vulnerable to an unauthenticated server-side request forgery vulnerability in the /webapi/proxy endpoint. The endpoint accepts a URL in the POST request body and fetches it server-side without authentication. !/usr/bin/env python3 -- coding...

Emby Installation Page - Exposure Detection

Checks for the presence of a Emby Installer Page. !/usr/bin/env python3 -- coding: utf-8 -- """Checks for the presence of a Emby Installer Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Emby Installation Page ...

Chainlit Panel - Detect

Chainlit panel was detected. Chainlit is an open-source framework for building production-ready conversational AI applications. !/usr/bin/env python3 -- coding: utf-8 -- """Chainlit panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting Detection

WordPress MW Font Changer plugin 4.2.5 and before contains a cross-site scripting vulnerability which allows an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Loytec Device Info Detection

Loytec Device info panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Loytec Device info panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Loytec Device Info Detection', 'description':...

Joomla! Component Percha Downloads Attach 1.1 - Directory Traversal Detection

A directory traversal vulnerability in the Percha Downloads Attach comperchadownloadsattach component 1.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 --...

Huawei Firewall - Local File Inclusion Detection

USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gai...

WordPress Transposh <=1.0.8.1 - Information Disclosure Detection

WordPress Transposh plugin through is susceptible to information disclosure via the AJAX action tphistory, which is intended to return data about who has translated a text given by the token parameter. However, the plugin also returns the user's login name as part of the userlogin attribute. If a...

Ipswitch IMail Server - Detect

Detects servers running Ipswitch IMail by identifying the Server header in HTTP responses. !/usr/bin/env python3 -- coding: utf-8 -- """Detects servers running Ipswitch IMail by identifying the Server header in HTTP responses.""" from kittysploit import from lib.protocols.http.httpclient import...

Gryphon Panel - Detect

Gryphon router panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gryphon router panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Gryphon Panel - Detect', 'description': 'Gryphon rout...

Github Gemfiles Detection

Find github page filesGemfile / Gemfile.lock !/usr/bin/env python3 -- coding: utf-8 -- """Find github page filesGemfile / Gemfile.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Github Gemfiles Detection',...

Darcs Configuration - Detect

Darcs configuration was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Darcs configuration was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Darcs Configuration - Detect', 'description': 'Darcs...

gSOAP 2.8 - Local File Inclusion Detection

gSOAP 2.8 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """gSOAP 2.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'gSOAP 2.8 - Local File Inclusion Detection',...

WordPress WooCommerce - Directory Search Detection

WordPress WooCommerce plugin sensitive directory searches were conducted. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WooCommerce plugin sensitive directory searches were conducted.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Grafana Unauthenticated Access Detection

Detects Grafana instances configured with anonymous access enabled, allowing unauthenticated users to access dashboards, data sources, organization info, and potentially sensitive monitoring data without any credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Grafana instances...

Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass Detection

Email Verification for WooCommerce Wordpress plugin prior to version 1.8.2 contains a loose comparison issue which could allow any user to log in as administrator. !/usr/bin/env python3 -- coding: utf-8 -- """Email Verification for WooCommerce Wordpress plugin prior to version 1.""" import re fro...