Altair WordPress theme v4.8 - Directory Listing Detection

Searches for directories listing in the altair theme. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for directories listing in the altair theme.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Altair WordPres...

WordPress Ambience Theme <=1.0 - Cross-Site Scripting Detection

WordPress Ambience Theme 1.0 and earlier was affected by a cross-site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ambience Theme 1.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress Blogroll Fun-Show Last Post and Last Update Time 0.8.4 - Cross-Site Scripting Detection

WordPress Plugin Blogroll Fun-Show Last Post and Last Update Time 0.8.4 and possibly prior versions are prone to a cross-site scripting vulnerability because of a failure to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser ...

WordPress Breadcrumb NavXT - Full Path Disclosure Detection

The Breadcrumb NavXT plugin for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Breadcrum...

WordPress Plugin Enable Media Replace - Log File Exposure Detection

The WordPress plugin "Enable Media Replace" enable-media-replace bundles a ShortPixel-based logger that writes a plugin-specific log file into the WordPress uploads directory, typically as wp-content/uploads/EnableMediaReplace.log. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress plugin...

WordPress Google Analytics - Full Path Disclosure Detection

Detected WordPress Google Analytics Dashboard Plugin for WordPress by MonsterInsights, potentially revealing analytics data, file paths, and errors. !/usr/bin/env python3 -- coding: utf-8 -- """Detected WordPress Google Analytics Dashboard Plugin for WordPress by MonsterInsights, potentially...

WordPress Hostinger Tools - Full Path Disclosure Detection

WordPress Plugin Hostinger Tools files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Hostinger Tools files are publicly accessible...

Image Widget - Full Path Disclosure Detection

Image Widget WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Image Widget WordPress plugin...

WordPress Plugin Iwp-client Listing Detection

Searches for sensitive directories present in the iwp-client plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the iwp-client plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

JetPack - Full Path Disclosure Detection

JetPack WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """JetPack WordPress plugin contains ...

WordPress license file disclosure Detection

Leaked WordPress license file. !/usr/bin/env python3 -- coding: utf-8 -- """Leaked WordPress license file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress license file disclosure Detection', 'description':...

WordPress wp-links-opml.php - Version Disclosure Detection

WordPress wp-links-opml.php file was publicly accessible and expossed the WordPress version in the generator tag. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress wp-links-opml.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

WordPress Members Plugin - Debug/Error Log Disclosure Detection

The WordPress Members plugin exposes error/debug log files that may contain sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress Members plugin exposes error/debug log files that may contain sensitive information.""" import re from kittysploit import from...

WordPress Plugin Newsletter - Full Path Disclosure Detection

WordPress Plugin Newsletter plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Newsletter plugin files are publicly accessible...

WordPress Oxygen-Theme - Local File Inclusion Detection

WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.php'. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Oxygen-Theme has a local file inclusion vulnerability via the 'file' parameter of 'download.""" from kittysploit import from...

WordPress Popup Plugin Directory Listing Detection

Searches for sensitive directories present in the wordpress-popup plugin. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for sensitive directories present in the wordpress-popup plugin.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

WordPress Pretty Links - Full Path Disclosure Detection

WordPress Pretty Links plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pretty Links plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress Securimage-WP 3.2.4 - Cross-Site Scripting Detection

WordPress Securimage-WP 3.2.4 plugin contains a cross-site scripting vulnerability via siwptest.php. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials an...

WordPress Plugin SG Optimizer - Full Path Disclosure Detection

WordPress Plugin SG Optimizer Plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin SG Optimizer Plugin files are publicly...

Simple 301 Redirects - Full Path Disclosure Detection

Simple 301 Redirects WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Simple 301 Redirects...

WP Smushit - Full Path Disclosure Detection

Smushit WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Smushit WordPress plugin contains ...

WordPress SocialFit - Cross-Site Scripting Detection

WordPress SocialFit is vulnerable to a cross-site scripting vulnerability via the 'msg' parameter because it fails to properly sanitize user-supplied input. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress SocialFit is vulnerable to a cross-site scripting vulnerability via the 'msg' paramet...

WordPress WPtouch 3.7.5 - Open Redirect Detection

WordPress WPtouch 3.7.5 is affected by an Open Redirect issue. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WPtouch 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress WPtouch 3.7.5 - Ope...

WordPress Upward Themes <1.5 - Open Redirect Detection

WordPress Upward Themes 1.5 accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. An http parameter may contain a URL value and could cause the web application to redirect the request to the specified URL. By...

WordPress W3 Total Cache - Cache Files Exposure Detection

Detects publicly accessible W3 Total Cache database cache files in the wp-content/w3tc/dbcache/ directory. When database caching to disk is enabled, these files contain raw SQL query results, potentially exposing sensitive data such as user details, password hashes, emails, or other database...

Product Input Fields for WooCommerce < 1.2.7 - Unauthenticated File Download Detection

WordPress WooCommerce 1.2.7 is susceptible to file download vulnerabilities. The lack of authorization checks in the handledownloads function hooked to admininit could allow unauthenticated users to download arbitrary files from the blog using a path traversal payload. !/usr/bin/env python3 --...

Wordfence - Full Path Disclosure Detection

Wordfence WordPress plugin contains a full path disclosure vulnerability due to improper access restrictions in its source files, allowing unauthenticated attackers to retrieve full server paths and aiding exploitation. !/usr/bin/env python3 -- coding: utf-8 -- """Wordfence WordPress plugin...

WordPress WPForms - Full Path Disclosure Detection

WordPress Plugin WPForms files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WPForms files are publicly accessible without ABSPATH...

WordPress Plugin WP Statistics Error Log Disclosure Detection

Detected exposed log files generated by the WP Statistics !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed log files generated by the WP Statistics.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

WordPress Yoast SEO - Full Path Disclosure Detection

WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Yoast SEO plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WSO2 <5.8.0 - Server Side Request Forgery Detection

WSO2 prior to version 5.8.0 is susceptible to a server-side request forgery vulnerability. This vulnerability can be exploited by misusing the UI gadgets loading capability of the shindig web application. An attacker can alter a specific URL in the request causing the server to initiate a GET...

Wuzhicms Detected

Wuzhicms was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wuzhicms was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wuzhicms Detected', 'description': 'Wuzhicms was detected.', 'author':...

XBackBone Installer - Exposure Detection

Checks for the presence of a XBackBone Installer. !/usr/bin/env python3 -- coding: utf-8 -- """Checks for the presence of a XBackBone Installer.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XBackBone Installer -...

Xerox DC260 EFI Fiery Controller Webtools 2.0 - Local File Inclusion Detection

Xerox DC260 EFI Fiery Controller Webtools 2.0 is vulnerable to local file inclusion because input passed thru the 'file' GET parameter in 'forceSave.php' script is not properly sanitized before being used to read files. This can be exploited by an unauthenticated attacker to read arbitrary files ...

XML Schema Detection

Detects XML Schema Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects XML Schema Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XML Schema Detection', 'description': 'Detects XML Schema...

XNAT Login Panel - Detect

XNAT login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """XNAT login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'XNAT Login Panel - Detect', 'description': 'XNAT login panel...

Xymon - Exposure Detection

Detected the exposure of the Xymon monitoring system interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detected the exposure of the Xymon monitoring system interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

X-Backend-Server Header - Exposure Detection

Detected that the website returned the X-Backend-Server header, which included potentially internal or hidden IP addresses or hostnames. By exposing these values, attackers might have attempted to circumvent security proxies and access these hosts directly. !/usr/bin/env python3 -- coding: utf-8 ...

Yii Error Page - Detct Detection

Yii An application framework to handle and manage errors error page detected. !/usr/bin/env python3 -- coding: utf-8 -- """Yii An application framework to handle and manage errors error page detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Yonyou UFIDA NC - Information Exposure Detection

After logging in and visiting the address where the information was leaked, you will have permission to upload files. Then just go back to the homepage and view the published content directly. !/usr/bin/env python3 -- coding: utf-8 -- """After logging in and visiting the address where the...

YonBIP - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in yonbiplogin, the advanced version of YonBIP !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in yonbiplogin, the advanced version of YonBIP.""" import re from kittysploit import from...

YunoHost Admin Panel - Detect

YunoHost Admin panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """YunoHost Admin panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YunoHost Admin Panel - Detect', 'description':...

Zabbix Installation Exposure Detection

Zabbix is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zabbix Login Panel - Detect

Zabbix login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zabbix login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zabbix Login Panel - Detect', 'description': 'Zabbix logi...

Zammad Helpdesk Panel - Detect

Zammad is an open source helpdesk and customer support system that provides ticket management, live chat, and knowledge base functionality. This template detects exposed Zammad installations. !/usr/bin/env python3 -- coding: utf-8 -- """Zammad is an open source helpdesk and customer support syste...

Zend Server Test Page Detection

Detects Zend Server Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Zend Server Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zend Server Test Page Detection', 'description': 'Detects Zen...

Zentao Panel - Detect

Zentao panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zentao panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zentao Panel - Detect', 'description': 'Zentao panel was detected.',...

ZenML Dashboard Panel - Detect

Detects ZenML Dashboard Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ZenML Dashboard Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ZenML Dashboard Panel - Detect',...

Zhiyuan OA Arbitrary File Upload Vulnerability Detection

A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload arbitrary files to the remote server and cause execute arbitrary code to be executed. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload...

Zhiyuan OA Session Leak Detection

A vulnerability in Zhiyuan OA allows remote unauthenticated users access to sensitive session information via the 'getSessionList.jsp' endpoint. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Zhiyuan OA allows remote unauthenticated users access to sensitive session information v...