Langflow AI - Unauthenticated Remote Code Execution

Langflow 1.3.0 code injection via /api/v1/validate/code allows unauthenticated RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Langflow AI - Unauthenticated Remote Code Execution""" import json import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

VMware vRealize Log Insight - Improper Access Control to RCE Detection

The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """The vRealize Log Insight...

Twonky Server 8.5.2 on Linux and Windows - Log File Exposure Detection

Twonky Server 8.5.2 contains a broken access control vulnerability caused by bypassing web service API authentication, letting unauthenticated attackers read log files with administrator credentials, exploit requires no authentication !/usr/bin/env python3 -- coding: utf-8 -- """Twonky Server 8."...

Sympa version =>6.2.16 - Cross-Site Scripting Detection

Sympa version 6.2.16 and later contains a URL Redirection to Untrusted Site vulnerability in the referer parameter of the wwsympa fcgi login action that can result in open redirection and reflected cross-site scripting via data URIs. !/usr/bin/env python3 -- coding: utf-8 -- """Sympa version 6.""...

Prometheus - Open Redirect Detection

Prometheus 2.23.0 through 2.26.0 and 2.27.0 contains an open redirect vulnerability. To ensure a seamless transition to 2.27.0, the default UI was changed to the new UI with a URL prefixed by /new redirect to /. Due to a bug in the code, an attacker can redirect a user to a malicious site and...

Apache Flink - Local File Inclusion Detection

Apache Flink 1.11.0 and released in 1.11.1 and 1.11.2 as well allows attackers to read any file on the local filesystem of the JobManager through the REST interface of the JobManager process aka local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Flink 1.""" import re from...

Lighttpd 1.4.34 SQL Injection and Path Traversal Detection

A SQL injection vulnerability in modmysqlvhost.c in lighttpd before 1.4.35 allows remote attackers to execute arbitrary SQL commands via the host name related to requestcheckhostname. !/usr/bin/env python3 -- coding: utf-8 -- """A SQL injection vulnerability in modmysqlvhost.""" import re from...

SPIP Porte Plume Plugin - Remote Code Execution Detection

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """Th...

LearnDash LMS < 4.10.3 - Sensitive Information Exposure Detection

The LearnDash LMS plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.10.2 via API. This makes it possible for unauthenticated attackers to obtain access to quiz questions. !/usr/bin/env python3 -- coding: utf-8 -- """The LearnDash LMS plug...

MeteoBridge <= 6.1 - Remote Code Execution Detection

The Meteobridge web interface let meteobridge administrator manage their weather station data collection and administer their meteobridge system through a web application written in CGI shell scripts and C.This web interface exposes an endpoint that is vulnerable to command injection.Remote...

Roundcube CVE-2025-49113 Detection

Fingerprints Roundcube via rcversion and flags builds before 1.5.10 / 1.6.x before 1.6.11 as vulnerable to post-auth PHP deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Roundcube versions vulnerable to CVE-2025-49113.""" from kittysploit import from...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts Detection

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress before 5.""" import re from kittysploit impo...

CentreStack Login Panel - Detect

Gladinet CentreStack login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gladinet CentreStack login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CentreStack Login Panel -...

Adminer <=4.8.0 - Cross-Site Scripting Detection

Adminer 4.6.1 to 4.8.0 contains a cross-site scripting vulnerability which affects users of MySQL, MariaDB, PgSQL, and SQLite in browsers without CSP when Adminer uses a pdo extension to communicate with the database it is used if the native extensions are not enabled. !/usr/bin/env python3 --...

Ellucian Ethos Identity CAS - Cross-Site Scripting Detection

A vulnerability was found in Ellucian Ethos Identity up to 5.10.5. It has been classified as problematic. Affected is an unknown function of the file /cas/logout. The manipulation of the argument url leads to cross site scripting. It is possible to launch the attack remotely. !/usr/bin/env python...

Citrix Netscaler ADC & Gateway - Out-Of-Bounds Memory Read Detection

The vulnerability would enable an attacker to remotely obtain sensitive information from a NetScaler appliance configured as a Gateway or AAA virtual server via a very commonly connected Web interface, and without requiring authentication. This bug is nearly identical to the Citrix Bleed...

WonderCMS Detect

Detects WonderCMS Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects WonderCMS Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WonderCMS Detect', 'description': 'Detects WonderCMS Detect.', 'author'...

WordPress gtranslate Plugin Directory Listing Detection

Searches for sensitive directories present in the gtranslate wordpress plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the gtranslate wordpress plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Hestia Control Panel Login - Detect

Hestia Control Panel login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Hestia Control Panel login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hestia Control Panel Login - Detect',...

CS-Cart - Local File Inclusion Detection

CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers to access locally stored files and reveal their content. !/usr/bin/env python3 -- coding: utf-8 -- """CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers t...

Accept Donations with PayPal <= 1.5.2 - Open Redirect Detection

The Accept Donations with PayPal & Stripe plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 1.5.2. This is due to insufficient validation on the redirect url supplied. This makes it possible for unauthenticated attackers to redirect users to potentially...

AdmiralCloud - Detect

AdmiralCloud was detected. !/usr/bin/env python3 -- coding: utf-8 -- """AdmiralCloud was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AdmiralCloud - Detect', 'description': 'AdmiralCloud was detected.',...

Oracle WebCenter Sites Detection

Detects Oracle WebCenter Sites. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Oracle WebCenter Sites.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oracle WebCenter Sites Detection', 'description': 'Detects...

SeaweedFS Filer - Unauthenticated Access Detection

SeaweedFS Filer interface is exposed without authentication.Unauthenticated users may be able to upload, modify, or access files, potentially leading to malicious file hosting, data exposure, or remote compromise. !/usr/bin/env python3 -- coding: utf-8 -- """SeaweedFS Filer interface is exposed...

DD-WRT Control Panel - Exposure Detection

The DD-WRT web interface was found exposed without proper access controls, potentially allowing unauthorized users to view. !/usr/bin/env python3 -- coding: utf-8 -- """The DD-WRT web interface was found exposed without proper access controls, potentially allowing unauthorized u.""" from...

Sophos Firewall <=18.5 MR3 - Remote Code Execution Detection

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall version v18.""" from kittysploit import from...

bloofoxCMS Login Panel - Detect

Detects bloofoxCMS Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects bloofoxCMS Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'bloofoxCMS Login Panel - Detect',...

Dolphin Installer - Exposure Detection

Dolphin is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Dolphin is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Danswer Panel - Detect

Danswer panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Danswer panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Danswer Panel - Detect', 'description': 'Danswer panel was...

Axigen Mail Server Filename Directory Traversal Detection

Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a .. dot dot in the fileName parameter in a download action to source/loggin/pagelogdwnfile.hsp, or the fileName parameter in an edi...

SMF Installer Detection

SMF is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """SMF is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache Pinot < 1.3.0 - Authentication Bypass Detection

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special...

mojoPortal <=2.9.0.1 - Directory Traversal Detection

mojoPortal =2.9.0.1 is vulnerable to Directory Traversal via BetterImageGallery API Controller - ImageHandler Action. An attacker can exploit this vulnerability to access the Web.Config file and obtain the MachineKey. !/usr/bin/env python3 -- coding: utf-8 -- """mojoPortal =2.""" from kittysploit...

Magmi 0.7.22 - Cross-Site Scripting Detection

Magmi 0.7.22 contains a cross-site scripting vulnerability due to insufficient filtration of user-supplied data prefix passed to the magmi-git-master/magmi/web/ajaxgettime.php URL. !/usr/bin/env python3 -- coding: utf-8 -- """Magmi 0.""" from kittysploit import from lib.protocols.http.httpclient...

Visual Studio Code Settings - Credential Exposure Detection

Detected exposed Visual Studio Code configuration files that were accessible over HTTP, which could have led to credential leakage or sensitive workspace disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Visual Studio Code configuration files that were accessible over HTTP...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability...

Readarr Dashboard - Unauthenticated Detection

Exposure of Readarr dashboard which can lead to sensitive information disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Exposure of Readarr dashboard which can lead to sensitive information disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Nginx Config - Detect

Nginx configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nginx configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Config - Detect',...

Caddy 2.4.6 - Open Redirect Detection

Caddy 2.4.6 contains an open redirect vulnerability. An attacker can redirect a user to a malicious site via a crafted URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Caddy 2.""" import re from...

Apache Kafka Client - Arbitrary File Read Detection

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

Grafana <= 6.7.1 - Cross-Site Scripting Detection

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

WordPress Oxygen-Theme - Local File Inclusion Detection

WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.""" from kittysploit import from...

WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal Detection

A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the dewfile parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in...

ZenML ZenML Server - Improper Authentication Detection

ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/usernameorid/activate REST API endpoint allows access on the basis of a valid username along with a new password in the request body. !/usr/bin/env python3 --...

Bytebase Auth - Panel Detect

Bytebase authentication interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Bytebase authentication interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bytebase Auth - Panel...

Vite Dev Server - Information Exposure Detection

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Django RasterField - SQL Injection Detection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. !/usr/bin/env python3 -- coding: utf-8 -- """Django 6.""" from kittysploit import...

Docmosis Tornado Server Exposure Detection

Docmosis Tornado Server is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Docmosis Tornado Server is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Docmosis Tornado Server Exposure Detection',...

Eclipse Jetty ConcatServlet - Information Disclosure Detection

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

Linkwarden Panel - Detect

Linkwarden linkwarden.app / github.com/linkwarden/linkwarden is a popular open-source self-hosted bookmark and link archiving manager. Default Docker port 3000. Exposed instances may reveal users' archived link collections, screenshots, and PDFs. !/usr/bin/env python3 -- coding: utf-8 --...