Expect-CT Header - Misconfigured Detection

Detected misconfigured Expect-CT headers: max-age is 0 ineffective and enforce directive is missing !/usr/bin/env python3 -- coding: utf-8 -- """Detected misconfigured Expect-CT headers: max-age is 0 ineffective and enforce directive is missing.""" from kittysploit import from...

Nacos 1.x - Authentication Bypass Detection

Nacos 1.x was discovered. A default Nacos instance needs to modify the application.properties configuration file or add the JVM startup variable Dnacos.core.auth.enabled=true to enable the authentication function reference: https://nacos.io/en-us/docs/auth.html. But authentication can still be...

iSpy 7.2.2.0 - Authentication Bypass Detection

iSpy 7.2.2.0 contains an authentication bypass vulnerability. An attacker can craft a URL and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """iSpy 7.""" from kittysploit import from...

WordPress Plugin Advanced Dewplayer 1.2 - Directory Traversal Detection

A directory traversal vulnerability in download-file.php in the Advanced Dewplayer plugin 1.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the dewfile parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in...

n8n >= 0.123.0 and < 1.121.3 - Remote Code Execution Detection

n8n versions = 0.123.0 and = 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'n8n = 0.123.0 and = 0.123.0 and 1.121.3 contain a critical authenticated remote code execution vulnerability via arbitrary file write. A...

TemboSocial Admin Panel - Detect

TemboSocial Admin panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TemboSocial Admin panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TemboSocial Admin Panel - Detect', 'description...

vLLM OpenAI-Compatible API - Unauthenticated Exposure Detection

Detects a vLLM inference server exposing its OpenAI-compatible API without authentication. The /v1/models endpoint returns the list of served models and is reachable by any unauthenticated client, allowing model enumeration and unauthorized inference resource abuse / cost and information exposure...

Gitblit 1.9.3 - Local File Inclusion Detection

Gitblit 1.9.3 is vulnerable to local file inclusion via /resources//../ e.g., followed by a WEB-INF or META-INF pathname. !/usr/bin/env python3 -- coding: utf-8 -- """Gitblit 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

GeoServer - Missing Authorization on REST API Index Detection

GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information. !/usr/bin/env python3 -- coding: utf-8 -- """GeoServer contains a missing authorization vulnerability that allows...

XenForo Forum Detection

Detects XenForo Forum Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects XenForo Forum Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XenForo Forum Detection', 'description': 'Detects XenForo...

Dgraph <= 25.3.2 - Admin Token Disclosure Detection

Dgraph = 25.3.2 contains an information disclosure caused by unauthenticated access to the /debug/vars endpoint , which publishes the cmdline variable including the --security token= flag, letting unauthenticated remote attackers retrieve the admin token and access admin-only endpoints, exploit...

Xerox DC260 EFI Fiery Controller Webtools 2.0 - Local File Inclusion Detection

Xerox DC260 EFI Fiery Controller Webtools 2.0 is vulnerable to local file inclusion because input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files ...

Yonyou YonBIP - Path Traversal Detection

Yonyou YonBIP v3 and before contains a path traversal caused by improper validation in the LoginWithV8 interface of the series data application service system, letting unauthorized attackers access sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou YonBIP v3 and before...

Azure - APIM Secret Key Detection

Azure APIM Secret Key !/usr/bin/env python3 -- coding: utf-8 -- """Azure APIM Secret Key.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Azure - APIM Secret Key Detection', 'description': 'Azure APIM Secret Key',...

AC Smart II - Authentication Bypass Detection

AC Smart II contains an authentication bypass caused by a hidden password reset form that can be manipulated to change the administrator password without verifying login or permissions, letting attackers change admin passwords without authorization. !/usr/bin/env python3 -- coding: utf-8 -- """AC...

Jenzabar 9.2x-9.2.2 - Cross-Site Scripting Detection

Jenzabar 9.2.x through 9.2.2 contains a cross-site scripting vulnerability. It allows /ics?tool=search&query. !/usr/bin/env python3 -- coding: utf-8 -- """Jenzabar 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect Detection

The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. !/usr/bin/env...

DATAGERRY - REST API Auth Bypass Detection

Incorrect access control in BECN DATAGERRY v2.2 allows attackers to execute arbitrary commands via crafted web requests. !/usr/bin/env python3 -- coding: utf-8 -- """Incorrect access control in BECN DATAGERRY v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient clas...

Hashicorp Consul API Unauthenticated Detection

In HashiCorp Consul's API without authentication arises when Consul is improperly secured, exposing its endpoints to unauthorized access. !/usr/bin/env python3 -- coding: utf-8 -- """In HashiCorp Consul's API without authentication arises when Consul is improperly secured, exposing its endpoi."""...

Flyte Console <0.52.0 - Server-Side Request Forgery Detection

FlyteConsole is the web user interface for the Flyte platform. FlyteConsole prior to version 0.52.0 is vulnerable to server-side request forgery when FlyteConsole is open to the general internet. An attacker can exploit any user of a vulnerable instance to access the internal metadata server or...

NUUO Camera <=20250203 - OS Command Injection Detection

NUUO Camera up to 20250203 contains a command injection caused by manipulation of the 'log' argument in /handleconfig.php, letting remote attackers execute arbitrary commands, exploit requires remote access. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO Camera up to 20250203 contains a comman...

Bitrix Component - Cross-Site Scripting Detection

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to 1 enumerate attachments on the server and 2 execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim ha...

Purchase Order Management v1.0 - SQL Injection Detection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/viewdetails.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is...

Python Flask-Security - Open Redirect Detection

Python Flask-Security contains an open redirect vulnerability. Existing code validates that the URL specified in the next parameter is either relative or has the same network location as the requesting URL. Certain browsers accept and fill in the blanks of possibly incomplete or malformed URLs. A...

YesWiki <2022-07-07 - Cross-Site Scripting Detection

YesWiki before 2022-07-07 contains a cross-site scripting vulnerability via the id parameter in the AccueiL URL. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki before 2022-07-07 contains a cross-site scripting vulnerability via the id parameter in the AccueiL UR.""" from kittysploit import...

Appspace 6.2.4 - Server-Side Request Forgery Detection

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Appspace 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Appspace 6.2.4 - Server-Side...

PaperCut < 22.1.3 - Path Traversal Detection

PaperCut NG and PaperCut MF before 22.1.3 are vulnerable to path traversal which enables attackers to read, delete, and upload arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """PaperCut NG and PaperCut MF before 22.""" from kittysploit import from lib.protocols.http.httpclient import...

Budibase - Admin Installer Detection

Detected Budibase admin setup checklist endpoint was publicly accessible with no admin user created, allowing unauthenticated users to complete setup and gain full platform control. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Budibase admin setup checklist endpoint was publicly accessib...

Weaver OA 9.5 - Information Disclosure Detection

A vulnerability was found in Weaver OA 9.5 and classified as problematic. This issue affects some unknown processing of the file /building/backmgr/urlpage/mobileurl/configfile/jx2config.ini. The manipulation leads to files or directories accessible. The attack may be initiated remotely...

FOSSBilling < 0.5.3 - Cross-Site Scripting Detection

Cross-site Scripting XSS - Reflected in GitHub repository fossbilling/fossbilling prior to 0.5.4. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS - Reflected in GitHub repository fossbilling/fossbilling prior to 0.""" from kittysploit import from lib.protocols.http.httpclien...

WordPress Church Admin <0.810 - Cross-Site Scripting Detection

WordPress Church Admin plugin before 0.810 allows remote attackers to inject arbitrary web script or HTML via the address parameter via index.php/2015/05/21/churchadmin-registration-form/. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Church Admin plugin before 0.""" from kittysploit...

Erlang Port Mapper Daemon Detection

The erlang port mapper daemon is used to coordinate distributed erlang instances. His job is to keep track of which node name listens on which address. Hence, epmd map symbolic node names to machine addresses. !/usr/bin/env python3 -- coding: utf-8 -- """The erlang port mapper daemon is used to...

Tufin SecureTrack Login Panel - Detect

Tufin SecureTrack login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Tufin SecureTrack login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Tufin SecureTrack Login Panel -...

Adobe AEM ACS Common Exposure Detection

Adobe AEM ACS Common pages exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM ACS Common pages exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM ACS Common Exposure Detection',...

OpenEnergyMonitor emonCMS - Login Panel Detection

emonCMS is an open-source energy monitoring web application by OpenEnergyMonitor, used in homes and small businesses to track electricity, gas, and temperature. The login page is commonly exposed on port 80, 443, or 8010. !/usr/bin/env python3 -- coding: utf-8 -- """emonCMS is an open-source ener...

Ivanti Connect Secure Panel - Detect

Ivanti Connect Secure provides a seamless, cost-effective SSL VPN solution for remote and mobile users from any web-enabled device to corporate resources— anytime, anywhere. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Connect Secure provides a seamless, cost-effective SSL VPN solution for...

WireGuard Handshake Detection

Best-effort WireGuard detection by sending a Handshake Initiation on UDP 51820. Silent drops are common without a matching peer key. !/usr/bin/env python3 -- coding: utf-8 -- """Detect WireGuard endpoints via handshake probe on UDP 51820.""" from kittysploit import from...

AWS Elastic Beanstalk Detect

Detects AWS Elastic Beanstalk Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AWS Elastic Beanstalk Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AWS Elastic Beanstalk Detect', 'description':...

Uptime-Kuma < v1.23.0 - Improper Access Control Detection

Uptime-Kuma before v1.23.0 is vulnerable to an information disclosure issue due to missing authorization on the /api/badge/1/ping/24 endpoint. An unauthenticated attacker can access this endpoint to leak ping statistics, such as average ping and ping history, for existing monitors without needing...

PyTorch TorchServe - Detect

Detected PyTorch TorchServe, a model-serving framework for PyTorch models. The inference API default port 8080 answers GET /ping with "status":"Healthy" and exposes /api-description; the management API default port 8081 lists registered models at GET /models. An exposed management API permits...

Eclipse Jetty ConcatServlet - Information Disclosure Detection

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

Ruby on Rails <5.0.1 - Remote Code Execution Detection

Ruby on Rails before version 5.0.1 is susceptible to remote code execution because it passes user parameters as local variables into partials. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby on Rails before version 5.""" import re from kittysploit import from lib.protocols.http.httpclient impor...

OA E-Office officeserver.php Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the OA E-Office officeserver.php file. An attacker can download any file on the server through the vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the OA E-Office officeserver."""...

Roundcube CVE-2025-49113 Detection

Fingerprints Roundcube via rcversion and flags builds before 1.5.10 / 1.6.x before 1.6.11 as vulnerable to post-auth PHP deserialization RCE. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Roundcube versions vulnerable to CVE-2025-49113.""" from kittysploit import from...

Temenos Transact Login Panel - Detect

Temenos Transact login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Temenos Transact login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Temenos Transact Login Panel - Detect...

TYPSoft FTP Service - Detect

TYPSoft FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TYPSoft FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'TYPSoft FTP Service -...

School Dormitory Management System 1.0 - SQL Injection Detection

School Dormitory Management System 1.0 contains a SQL injection vulnerability via accounts/paymenthistory.php:31. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

cgit < 1.2.1 - Directory Traversal Detection

cGit 1.2.1 via cgitcloneobjects has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request. !/usr/bin/env python3 -- coding: utf-8 -- """cGit 1.""" import re from kittysploit import from...

Totaljs <3.2.3 - Local File Inclusion Detection

Total.js Platform before 3.2.3 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Total.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Totaljs 3.2.3 - Local File Inclusion Detection...

Airflow Experimental <1.10.11 - REST API Auth Bypass Detection

Airflow's Experimental API prior 1.10.11 allows all API requests without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Airflow's Experimental API prior 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...