Cofense Vision Login Panel - Detect

Cofense Vision login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cofense Vision login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cofense Vision Login Panel - Detect',...

ColdFusion Administrator Login Panel - Detect

ColdFusion Administrator login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """ColdFusion Administrator login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ColdFusion...

Adobe ColdFusion CFIDE - Directory Listing Detection

Detected Adobe ColdFusion CFIDE directory listing was exposed. This can reveal sensitive files and subdirectories including administrator interfaces, scripts, and application components. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Adobe ColdFusion CFIDE directory listing was exposed."""...

Discover Cold Fusion cfcache.map Files Detection

Adobe Cold Fusion cfcache.map file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe Cold Fusion cfcache.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Discover Cold Fusion cfcache.map Files Detection'...

Collibra Properties Exposure Detection

Detected exposed Collibra Properties. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Collibra Properties.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Collibra Properties Exposure Detection',...

Concrete5 - Installer Page Exposure Detection

Detects exposed Concrete5 Installation page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects exposed Concrete5 Installation page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Concrete5 - Installer Page Exposu...

Configuration File - Detect

Multiple configuration files were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple configuration files were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Configuration File - Detect',...

Contao Login Panel - Detect

Contao login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Contao login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Contao Login Panel - Detect', 'description': 'Contao logi...

NPM Debug Log Disclosure Detection

NPM Debug log file exposed. !/usr/bin/env python3 -- coding: utf-8 -- """NPM Debug log file exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NPM Debug Log Disclosure Detection', 'description': 'NPM Debug log...

Akamai Cache Detection

Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific response header value. !/usr/bin/env python3 -- coding: utf-8 -- """Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific respon.""" import re...

KindEditor 4.1.11 - Cross-Site Scripting Detection

KindEditor 4.1.11 contains a cross-site scripting vulnerability via the php/demo.php content1 parameter. !/usr/bin/env python3 -- coding: utf-8 -- """KindEditor 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Agentejo Cockpit 0.10.2 - Cross-Site Scripting Detection

Agentejo Cockpit 0.10.2 contains a reflected cross-site scripting vulnerability due to insufficient sanitization of the to parameter in the /auth/login route, which allows for injection of arbitrary JavaScript code into a web page's content. !/usr/bin/env python3 -- coding: utf-8 -- """Agentejo...

Event Espresso Core-Reg 4.10.7.p - Cross-Site Scripting Detection

Event Espresso Core-Reg 4.10.7.p is vulnerable to cross-site scripting in wp-content/plugins/event-espresso-core-reg/adminpages/messages/templates/eemsgadminoverview.template.php and allows remote attackers to inject arbitrary web script or HTML via the page parameter. !/usr/bin/env python3 --...

Rocket.Chat <3.9.1 - Information Disclosure Detection

Rocket.Chat through 3.9.1 is susceptible to information disclosure. An attacker can enumerate email addresses via the password reset function and thus potentially access sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 --...

GateOne 1.1 - Local File Inclusion Detection

GateOne 1.1 allows arbitrary file retrieval without authentication via /downloads/.. local file inclusion because os.path.join is incorrectly used. !/usr/bin/env python3 -- coding: utf-8 -- """GateOne 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection Detection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Maximo Asset Manageme...

D-Link DIR-610 Devices - Information Disclosure Detection

D-Link DIR-610 devices allow information disclosure via SERVICES=DEVICE.ACCOUNT%0AAUTHORIZEDGROUP=1 to getcfg.php. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DIR-610 devices allow information...

Jellyfin <10.7.0 - Local File Inclusion Detection

Jellyfin before 10.7.0 is vulnerable to local file inclusion. This issue is more prevalent when Windows is used as the host OS. Servers exposed to public Internet are potentially at risk. !/usr/bin/env python3 -- coding: utf-8 -- """Jellyfin before 10.""" import re from kittysploit import from...

Revive Adserver <5.1.0 - Open Redirect Detection

Revive Adserver before 5.1.0 contains an open redirect vulnerability via the dest, oadest, and ct0 parameters of the lg.php and ck.php delivery scripts. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized...

CentOS Web Panel - OS Command Injection Detection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. !/usr/bin/env python3 -- coding: utf-8 -- """The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability...

WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection Detection

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...

Gnuboard 5 - Cross-Site Scripting Detection

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter.""" from kittysploit import from lib.protocols.http.httpclient import...

ExponentCMS <= 2.6 - Host Header Injection Detection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. !/usr/bin/env python3 -- coding: utf-8 -- """An HTTP Host header attack exists in...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

ECOA Building Automation System - Arbitrary File Retrieval Detection

The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information. !/usr/bin/env python3 -- coding: utf-8 -- """The ECOA BAS...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download Detection

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

Zabbix - SAML SSO Authentication Bypass Detection

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. !/usr/bin/env python3 -- coding: utf-8 -- """When SAML SSO authentication is enabled non-default, session data can be modified by a...

MeterSphere < 2.5.0 SSRF Detection

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in...

SAP Internet Graphics Server (IGS) Detection

Detection of SAP Internet Graphics Server IGS !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP Internet Graphics Server IGS.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SAP Internet Graphics Server I...

SAPControl ListConfigFiles - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the ListConfigFiles web method without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the...

SAP NetWeaver - Backdoor Detection

Detected a potential backdoor in SAP NetWeaver allowing unauthorized command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Detected a potential backdoor in SAP NetWeaver allowing unauthorized command execution.""" from kittysploit import from lib.protocols.http.httpclient import...

SAP NetWeaver ICM - Detect

Detection of SAP NetWeaver ABAP Webserver or Java Application Server ICM/ICF !/usr/bin/env python3 -- coding: utf-8 -- """Detection of SAP NetWeaver ABAP Webserver or Java Application Server ICM/ICF.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

SAPControl ReadDeveloperTrace Log - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the ReadDeveloperTrace web method without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the...

Sauter moduWeb Login Panel - Detect

Sauter moduWeb login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Sauter moduWeb login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Sauter moduWeb Login Panel - Detect',...

Scan2Net - Panel Detection

Scan2Net Login was detected. This software is used to manage ImageAccess devices.Universities and public institutions often use ImageAccess devices. !/usr/bin/env python3 -- coding: utf-8 -- """Scan2Net Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import...

ScriptCase Panel Detect

Detects ScriptCase Panel Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ScriptCase Panel Detect.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ScriptCase Panel Detect', 'description': 'Detec...

SCS Remote Monitoring and Control Login Panel - Detect

SCS Remote Monitoring and Control login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SCS Remote Monitoring and Control login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SCS...

Seafile Panel - Detect

Seafile panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seafile panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seafile Panel - Detect', 'description': 'Seafile panel was...

Seagate NAS Login - Detect

Seagate NAS - SEAGATE Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS - SEAGATE Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seagate NAS Login - Detect',...

SecMail Login Panel - Detect

SecMail login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SecMail login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SecMail Login Panel - Detect', 'description': 'SecMail...

SecNet Login Panel - Detect

SecNet login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SecNet login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SecNet Login Panel - Detect', 'description': 'SecNet logi...

Secret Token Ruby - File Disclosure Detection

Ruby Secret token is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Ruby Secret token is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Secret Token Ruby - File Disclosure Detection', 'description':...

Secure Login Service Login Panel - Detect

Secure Login Service login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Secure Login Service login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Secure Login Service Login...

Seeyon OA A6 createMysql.jsp Database - Information Disclosure Detection

Seeyon OA A6 has leaked sensitive database information. An attacker can obtain the database account and password MD5 by accessing a specific URL. !/usr/bin/env python3 -- coding: utf-8 -- """Seeyon OA A6 has leaked sensitive database information.""" import re from kittysploit import from...

SelfCheck System Manager - Panel Detection

Detects SelfCheck System Manager - Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects SelfCheck System Manager - Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SelfCheck System Manager - Panel...

SentinelOne Management Console Login Panel - Detect

SentinelOne Management Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SentinelOne Management Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SentinelO...

SequoiaDB Login Panel - Detect

SequoiaDB login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SequoiaDB login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SequoiaDB Login Panel - Detect', 'description':...

Seq Dashboard - Unauthenticated Detection

Seq is exposed without authentication !/usr/bin/env python3 -- coding: utf-8 -- """Seq is exposed without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seq Dashboard - Unauthenticated Detection',...