ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure Detection

ADB formerly Pirelli Broadband Solutions P.DGA4001N router with firmware PDGTEFSP4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service device restart as demonstrated by a direct request to 1...

Vanna - SQL injection Detection

Vanna v0.3.4 is vulnerable to SQL injection in its DuckDB integration exposed to its Flask Web APIs. Attackers can inject malicious SQL training data and generate corresponding queries to write arbitrary files on the victim's file system, such as backdoor.php with contents . This can lead to...

Qlik Sense Server Panel - Detect

Qlik Sense Server panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Qlik Sense Server panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Qlik Sense Server Panel - Detect', 'description...

OpenVPN Access Server - Configuration Exposure Detection

Detected OpenVPN Access Server with sensitive configuration data exposed, including VPN client profiles, certificates, private keys, and session tokens, without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected OpenVPN Access Server with sensitive configuration data exposed,...

Desktop Portal VMware Horizon DaaS Trade Platform Detection

Detects Desktop Portal VMware Horizon DaaS Trade Platform. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Desktop Portal VMware Horizon DaaS Trade Platform.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Deskt...

Online Farm Management System 0.1.0 - Cross-Site Scripting Detection

Online Farm Management System 0.1.0 contains a cross-site scripting vulnerability via the review.php file. !/usr/bin/env python3 -- coding: utf-8 -- """Online Farm Management System 0.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

LibreNMS Login Panel - Detect

LibreNMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """LibreNMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LibreNMS Login Panel - Detect', 'description':...

Roxy File Manager - Panel Detect

Roxy File Manager panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Roxy File Manager panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Roxy File Manager - Panel Detect', 'description...

BeyondTrust Remote Support Panel - Detect

Detect BeyondTrust Remote Support Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detect BeyondTrust Remote Support Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BeyondTrust Remote Support Panel - Detect...

Geddy <13.0.8 - Local File Inclusion Detection

Geddy prior to version 13.0.8 contains a directory traversal vulnerability in lib/app/index.js that allows remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the PATHINFO to the default URI. !/usr/bin/env python3 -- coding: utf-8 -- """Geddy prior to version 13.""" impo...

VertaAI ModelDB - Path Traversal Detection

The endpoint "/api/v1/artifact/getArtifact?artifactpath=" is vulnerable to path traversal. The main cause of this vulnerability is due to the lack of validation and sanitization of the artifactpath parameter. !/usr/bin/env python3 -- coding: utf-8 -- """The endpoint...

Teleport - Authentication Bypass Detection

Teleport versions prior to 17.5.2 are vulnerable to a remote authentication bypass vulnerability. This issue allows attackers to gain unauthorized access to affected systems. !/usr/bin/env python3 -- coding: utf-8 -- """Teleport versions prior to 17.""" from kittysploit import from...

Zend Server <9.13 - Cross-Site Scripting Detection

Zend Server before version 9.13 is vulnerable to cross-site scripting via the debughost parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Zend Server before version 9.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Memos Panel - Detect

Memos is a privacy-first, lightweight note-taking service !/usr/bin/env python3 -- coding: utf-8 -- """Memos is a privacy-first, lightweight note-taking service.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Memos...

Django Debug Configuration Enabled Detection

Django debug configuration is enabled, which allows an attacker to obtain system configuration information such as paths or settings. !/usr/bin/env python3 -- coding: utf-8 -- """Django debug configuration is enabled, which allows an attacker to obtain system configuration information suc.""" fro...

ESPHome Web Server access - Unauthenticated Access Detection

ESPHome is a powerful smart home devices with simple YAML configuration. !/usr/bin/env python3 -- coding: utf-8 -- """ESPHome is a powerful smart home devices with simple YAML configuration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

RemKon Device Manager Login Panel - Detect

RemKon Device Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """RemKon Device Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RemKon Device Manager Login...

Kube API Nodes Detection

Scans for kube nodes !/usr/bin/env python3 -- coding: utf-8 -- """Scans for kube nodes.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient from lib.scanner.http.probeguard import lookslikekubernetesnodelist, validatejsonprobe class ModuleScanner, Httpclient: info =...

Ignite Realtime Openfire <=4.4.2 - Server-Side Request Forgery Detection

Ignite Realtime Openfire through version 4.4.2 allows attackers to send arbitrary HTTP GET requests in FaviconServlet.java, resulting in server-side request forgery. !/usr/bin/env python3 -- coding: utf-8 -- """Ignite Realtime Openfire through version 4.""" from kittysploit import from...

Viminfo - File Disclosure Detection

Viminfo file was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Viminfo file was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Viminfo - File Disclosure Detection', 'description': 'Viminfo file wa...

Joomla JLex Review 6.0.1 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

NginX Auto Installer Exposure Detection

NginX Auto is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """NginX Auto is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Nginx Test Page for OpenCloudOS Detection

OpenCloudOS test page was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """OpenCloudOS test page was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Test Page for OpenCloudOS Detection',...

Apache Druid - Local File Inclusion Detection

Apache Druid ingestion system is vulnerable to local file inclusion. The InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of t...

VMWare Workspace ONE UEM - Server-Side Request Forgery Detection

VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5.0.37 contain a server-side request forgery vulnerability. This issue may allow a malicious actor with network access to UEM to send their requests without...

OpenSNS - Remote Code Execution Detection

OpenSNS allows remote unauthenticated attackers to execute arbitrary code via the 'shareBox' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSNS allows remote unauthenticated attackers to execute arbitrary code via the 'shareBox' endpoint.""" import re from kittysploit import from...

Reolink E1 Zoom Camera <=3.0.0.716 - Information Disclosure Detection

Reolink E1 Zoom camera through 3.0.0.716 is susceptible to information disclosure. The web server discloses its configuration via the /conf/ directory that is mapped to a publicly accessible path. An attacker with network-level access to the camera can can download the entire NGINX/FastCGI...

WordPress Download Manager <= 3.2.59 - Reflected XSS Detection

W3 Eden, Inc. Download Manager plugin = 3.2.59 contains a reflected cross-site scripting caused by insufficient input sanitization, letting attackers execute scripts in the context of the victim's browser, exploit requires attacker to craft a malicious link. !/usr/bin/env python3 -- coding: utf-8...

NGINX Shards Disclosure Detection

NGINX internal information, shards page exposed. !/usr/bin/env python3 -- coding: utf-8 -- """NGINX internal information, shards page exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NGINX Shards Disclosure...

AVCON6 org_execl_download.action - Arbitrary File Download Detection

Arbitrary File Download vulnerability in the orgexecldownload.action of the AVCON6 system management platform, through which an attacker can download arbitrary files from the server !/usr/bin/env python3 -- coding: utf-8 -- """Arbitrary File Download vulnerability in the orgexecldownload.""" impo...

SAUTER moduWeb Vision Panel - Detect

Sauter moduWeb Vision was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Sauter moduWeb Vision was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAUTER moduWeb Vision Panel - Detect', 'description...

Wavlink WN-533A8 - Cross-Site Scripting Detection

Wavlink WN-533A8 M33A8.V5030.190716 contains a reflected cross-site scripting vulnerability via the loginpage parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Wavlink WN-533A8 M33A8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

ExaGrid Manager Login Panel - Detect

ExaGrid Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ExaGrid Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ExaGrid Manager Login Panel - Detect',...

NUUO NVRmini 2 3.0.8 - Local File Inclusion Detection

NUUO NVRmini 2 3.0.8 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """NUUO NVRmini 2 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NUUO NVRmini 2 3.0.8 - Local File Inclusion...

Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting Detection

Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting XSS vulnerability via requesttoken.php. !/usr/bin/env python3 -- coding: utf-8 -- """Portal do Software Publico Brasileiro i3geo v7.""" from kittysploit import from lib.protocols.http.httpclient...

WordPress FastDup <= 2.1.9 Sensitive Information Exposure - Directory Listing Detection

FastDup WordPress plugin 2.2 contains a directory listing vulnerability caused by lack of access restrictions in sensitive directories, letting attackers view export files, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """FastDup WordPress plugin 2.""" from...

OCS Inventory Login Panel - Detect

OCS Inventory login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OCS Inventory login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OCS Inventory Login Panel - Detect',...

Nagios Login Panel - Detect

Nagios login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nagios login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nagios Login Panel - Detect', 'description': 'Nagios logi...

ConnectWise Server Backup Manager SE Panel - Detect

ConnectWise Server Backup Manager SE login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ConnectWise Server Backup Manager SE login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name'...

Dgraph Ratel Dashboard Exposure Panel - Detect

Dgraph Ratel Dashboard Exposure panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dgraph Ratel Dashboard Exposure panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dgraph Ratel...

Jira Unauthenticated Admin Projects Detection

Detects Jira Unauthenticated Admin Projects. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jira Unauthenticated Admin Projects.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jira Unauthenticated Admin Projec...

Liferay Portal & DXP - Cross-Site Scripting Detection

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay Portal 7."""...

WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting Detection

WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Supsystic Contact Form plugin before 1."""...

Exposed FileZilla Configuration File - Exposure Detection

Detected publicly accessible FileZilla client configuration files sitemanager.xml, recentservers.xml, filezilla.xml. !/usr/bin/env python3 -- coding: utf-8 -- """Detected publicly accessible FileZilla client configuration files sitemanager.""" from kittysploit import from...

Rallly Login - Panel Detect

Rallly login interface was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Rallly login interface was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Rallly Login - Panel Detect', 'description':...

HugeGraph - Detect

A huge graph technology was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A huge graph technology was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HugeGraph - Detect', 'description': 'A huge gra...

HyperDX Panel - Detect

HyperDX panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """HyperDX panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'HyperDX Panel - Detect', 'description': 'HyperDX panel was...

Ruckus Unleashed Exposed Installation Detection

Ruckus Unleashed is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Ruckus Unleashed is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import...

Paystack Secret/Live Key - Exposure Detection

Detected exposed Paystack secret keys test or live found in application source code, configuration files, or client-side assets. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Paystack secret keys test or live found in application source code, configuration files, or.""" import re...

ForgeRock IG Login/Welcome Page - Detect

Detects ForgeRock Identity Gateway login or welcome page and extracts version number !/usr/bin/env python3 -- coding: utf-8 -- """Detects ForgeRock Identity Gateway login or welcome page and extracts version number.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...