Agent-Zero 0.8.0 - 0.9.4 - Arbitrary File Download Detection

Agent-Zero v0.8.0 - 0.9.4 contains a path traversal caused by improper validation in /api/downloadworkdirfile.py, letting attackers access unauthorized files, exploit requires crafted request. !/usr/bin/env python3 -- coding: utf-8 -- """Agent-Zero v0.""" import re from kittysploit import from...

Adobe AEM Offloading Browser Detection

Adobe AEM Offloading Browser is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM Offloading Browser is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM Offloading Browser Detection',...

WebMvc.fn/WebFlux.fn - Path Traversal Detection

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Ruby on Rails - Accept Header LFI Detection (CVE-2019-5418)

Detects CVE-2019-5418 by sending Accept: ../../../../../../../../etc/passwd and looking for passwd contents in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Rails File Content Disclosure via Accept header CVE-2019-5418.""" import re from kittysploit import from...

Grafana <= 6.7.1 - Cross-Site Scripting Detection

Grafana through 6.7.1 contains an unauthenticated stored cross-site scripting vulnerability due to insufficient input protection in the originalUrl field, which allows an attacker to inject JavaScript code that will be executed after clicking on Open Original Dashboard after visiting the snapshot...

Casdoor - Authorization Bypass Detection

Casdoor up to 1.811.0 contains an authorization bypass caused by manipulation in HandleScim function in controllers/scim.go, letting remote attackers bypass authorization, exploit requires remote access. !/usr/bin/env python3 -- coding: utf-8 -- """Casdoor up to 1.""" from kittysploit import from...

Casdoor 1.13.0 - Unauthenticated SQL Injection Detection

Casdoor version 1.13.0 suffers from a remote unauthenticated SQL injection vulnerability via the query API in Casdoor before 1.13.1 related to the field and value parameters, as demonstrated by api/get-organizations. !/usr/bin/env python3 -- coding: utf-8 -- """Casdoor version 1.""" import re fro...

Chaosblade < 1.7.4 - Remote Code Execution Detection

exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """exec.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

InfluxDB <1.7.6 - Authentication Bypass Detection

InfluxDB before 1.7.6 contains an authentication bypass vulnerability via the authenticate function in services/httpd/handler.go. A JWT token may have an empty SharedSecret aka shared secret. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized...

WordPress Aspose PDF Exporter - Local File Inclusion Detection

WordPress Aspose PDF Exporter is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Aspose PDF Exporter is vulnerable to local file inclusion.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Flowise 1.4.3 - Arbitrary File Read Detection

Flowise 1.4.3 contains a path traversal caused by lack of sanitization of 'fileName' parameter in /api/v1/openai-assistants-file endpoint in index.ts, letting attackers read arbitrary files, exploit requires attacker to send crafted request. !/usr/bin/env python3 -- coding: utf-8 -- """Flowise...

Babel Configuration - Detect

Babel configuration information was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Babel configuration information was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Babel Configuration - Detect',...

FOSSBilling - Server-Side Template Injection

FOSSBilling stringrender API evaluates unsandboxed Twig, allowing SQL/info disclosure via guest.getDi.db.getCell. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling - Server-Side Template Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

Zabbix - SAML SSO Authentication Bypass Detection

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. !/usr/bin/env python3 -- coding: utf-8 -- """When SAML SSO authentication is enabled non-default, session data can be modified by a...

Ivanti Avalanche 6.3.2 - Local File Inclusion Detection

Ivanti Avalanche 6.3.2 is vulnerable to local file inclusion because it allows remote unauthenticated user to access files that reside outside the 'image' folder. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti Avalanche 6.""" from kittysploit import from lib.protocols.http.httpclient import...

WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure Detection

The 3D FlipBook WordPress plugin ≤ v1.16.17 has a vulnerability where an unauthenticated AJAX action fb3dsendposts exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization. !/usr/bin/env...

MochiWeb - Detect

Detected servers using the MochiWeb framework through the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers using the MochiWeb framework through the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

POS Codekop v2.0 - Cross Site Scripting Detection

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php. !/usr/bin/env python3 -- coding: utf-8 -- """POS Codekop v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 - Local File Inclusion Detection

Franklin Fueling Systems Colibri Controller Module 1.8.19.8580 is susceptible to local file inclusion because of insecure handling of a download function that leads to disclosure of internal files due to path traversal with root privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Franklin...

Ruijie RG-NBS2009G-P - Improper Authentication Detection

An issue in Ruijie RG-NBS2009G-P RGOS v.10.41P2 Release9736 allows a remote attacker to gain privileges via the system/configmenu.htm. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in Ruijie RG-NBS2009G-P RGOS v.""" from kittysploit import from lib.protocols.http.httpclient import...

ThinVNC - Authentication Bypass Detection

ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via a specific command, potentially leading to unauthorized access and code execution. !/usr/bin/env python3 -- coding: utf-8 -- """ThinVNC version 1.""" from kittysploit import from...

Kestra Login - Panel Detect

Kestra login interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Kestra login interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kestra Login - Panel Detect', 'description':...

Jupyter Notebook - Remote Command Execution Detection

Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Jupyter Notebook is an interactive Notebook, computer application i...

Cluster Control CMON API - Directory Traversal Detection

Directory Traversal vulnerability in Severalnines Cluster Control 1.9.8 before 1.9.8-9778, 2.0.0 before 2.0.0-9779, and 2.1.0 before 2.1.0-9780 allows a remote attacker to include and display file content in an HTTP request via the CMON API. !/usr/bin/env python3 -- coding: utf-8 -- """Directory...

User Meta WP Plugin < 3.1 - Sensitive Information Exposure Detection

The User Meta is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0 via the /views/debug.php file. This makes it possible for unauthenticated attackers, with to extract sensitive configuration data. !/usr/bin/env python3 -- coding: utf-8 -- """The User Meta is...

Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting Detection

Yonyou UFIDA ERP-NC V5.0 is vulnerable to reflected cross-site scripting XSS via the langcode parameter in /help/systop.jsp and /help/top.jsp. Unsanitized user input is reflected in the response, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """Yonyou UFIDA...

CandidATS 3.0.0 - Cross-Site Scripting. Detection

CandidATS 3.0.0 contains a cross-site scripting vulnerability via the indexFile parameter of the ajax.php resource. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication...

Vendure - Arbitrary File Read Detection

Vendure is an open-source headless commerce platform. Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data...

CaseAware a360inc - Cross-Site Scripting Detection

a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in 2017 !/usr/bin/env python3 -- coding: utf-8 -- """a360inc CaseAware contains a reflected cross-site scripting...

Webnus Inc. Modern Events Calendar - Broken Access Control Detection

Webnus Inc. Modern Events Calendar = 7.29.0 contains a broken access control vulnerability caused by incorrectly configured access control security levels, letting attackers bypass authorization, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Webnus Inc."""...

WAVLINK WN535 G3 - Information Disclosure Detection

WAVLINK WN535 G3 M35G3R.V5030.180927 is susceptible to information disclosure in the livemfg.shtml page. An attacker can obtain sensitive router information via the exec cmd function and possibly obtain additional sensitive information, modify data, and/or execute unauthorized operations...

Blackboard - Cross-Site Scripting Detection

Blackboard contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env pytho...

Adobe Coldfusion - Authentication Bypass Detection

Adobe ColdFusion versions 2023.5 and earlier and 2021.11 and earlier are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints...

LumisXP - Cross-site Scripting Detection

A cross-site scripting XSS vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting XSS vulnerability in the...

Somfy Login Panel - Detect

Somfy login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Somfy login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Somfy Login Panel - Detect', 'description': 'Somfy login...

Wordpress User Enumeration Detection

This template detects user enumeration in wordpress. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects user enumeration in wordpress.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wordpre...

Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting Detection

Open-School 3.0, and Community Edition 2.3, allows cross-site scripting via the osv/index.php?r=students/guardians/create id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Open-School 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Open edX <2022-06-06 - Cross-Site Scripting Detection

Open edX before 2022-06-06 contains a reflected cross-site scripting vulnerability via the 'next' parameter in the logout URL. !/usr/bin/env python3 -- coding: utf-8 -- """Open edX before 2022-06-06 contains a reflected cross-site scripting vulnerability via the 'next' parameter in.""" from...

FastMile 5G Gateway Panel - Detect

FastMile 5G Gateway web interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """FastMile 5G Gateway web interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FastMile 5G Gateway Pan...

WordPress WPFront Scroll Top - Full Path Disclosure Detection

WordPress Plugin WPFront Scroll Top plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WPFront Scroll Top plugin files are...

Reprise License Manager 14.2 - Information Disclosure Detection

Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostnames, system architecture and file/directory...

Siemens Logo! 8 Web - Panel Detection

Siemens Logo! 8 Web Login Panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Siemens Logo! 8 Web Login Panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Siemens Logo! 8 Web - Panel...

Pomerium Detect

A Pomerium SSO Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Pomerium SSO Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pomerium Detect', 'description': 'A Pomerium SSO Pane...

Magento Connect Manager Installer - Detect

Magento Connect Manager installer was detected. The software, available via /downloader/ location, requires Magento admin rights and uses the same authorization methods as for backend. If an attacker locates a matching pair of login/password, the installation will be compromised. An attacker can...

WordPress Duplicator <1.4.7 - Authentication Bypass Detection

WordPress Duplicator plugin before 1.4.7 is susceptible to authentication bypass. The plugin discloses the URL of the backup to unauthenticated visitors accessing the main installer endpoint. If the installer script has been run once by an administrator, this allows download of the full site back...

Cisco Identity Services Engine Admin Login Panel - Detect

Cisco Identity Services Engine admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Identity Services Engine admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Apache2 Ubuntu Default Page Detection

Detects Apache2 Ubuntu Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache2 Ubuntu Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache2 Ubuntu Default Page Detection',...

WordPress Plugin InfiniteWP Client - Full Path Disclosure Detection

WordPress InfiniteWP Client plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress InfiniteWP Client plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

Bugzilla - Config Exposed Detection

Because the config.cgi is publicly exposed, it is possible to enumerate main domain and possible users registered on Bugzilla server. !/usr/bin/env python3 -- coding: utf-8 -- """Because the config.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanne...

VMware vRealize Log Insight - Path Traversal Detection

he vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """he vRealize Log Insight contains a...