WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting Detection

WordPress Car Repair Services & Auto Mechanic before 4.0 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the serviceestimatekey parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Car Repair Services & Auto...

WordPress FoodBakery <2.2 - Cross-Site Scripting Detection

WordPress FoodBakery before 2.2 contains an unauthenticated reflected cross-site scripting vulnerability. It does not properly sanitize the foodbakeryradius parameter before outputting it back in the response. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress FoodBakery before 2.""" from...

WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting Detection

WordPress Pro Real Estate 7 theme before 3.1.1 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the ctcommunity parameter in its search listing page before outputting it back. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Pro Real Estate 7 theme befo...

WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting Detection

WordPress Calendar Event Multi View plugin before 1.4.01 contains an unauthenticated reflected cross-site scripting vulnerability. It does not sanitize or escape the 'start' and 'end' GET parameters before outputting them in the page via php/edit.php. !/usr/bin/env python3 -- coding: utf-8 --...

WordPress Podlove Podcast Publisher <3.5.6 - SQL Injection Detection

WordPress Podlove Podcast Publisher plugin before 3.5.6 is susceptible to SQL injection. The Social & Donations module, not activated by default, adds the REST route /services/contributor/?P\d+ and takes id and category parameters as arguments. Both parameters can be exploited, thereby potentiall...

WordPress Transposh Translation <1.0.8 - Cross-Site Scripting Detection

WordPress Transposh Translation plugin before 1.0.8 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the a parameter via an AJAX action available to both unauthenticated and authenticated users when the curl library is installed before outputting it back in...

WordPress Super Socializer <7.13.30 - Cross-Site Scripting Detection

WordPress Super Socializer plugin before 7.13.30 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape the urls parameter in its thechampsharingcount AJAX action available to both unauthenticated and authenticated users before outputting it back in the response...

Noptin < 1.6.5 - Open Redirect Detection

Noptin 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. !/usr/bin/env python3 -- coding: utf-8 -- """Noptin 1.""" import re from kittysploit import from...

Cacti - Cross-Site Scripting Detection

Cacti contains a cross-site scripting vulnerability via "http:///authchangepassword.php?ref=alert1" which can successfully execute the JavaScript payload present in the "ref" URL parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cacti contains a cross-site scripting vulnerability via...

Odoo <= 15.0 - Cross-Site Scripting Detection

A cross-site scripting XSS vulnerability in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote attackers to inject arbitrary web scripts into the browser of a victim via a crafted link. This issue could lead to the execution of malicious scripts in the context of t...

Appspace 6.2.4 - Server-Side Request Forgery Detection

Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Appspace 6.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Appspace 6.2.4 - Server-Side...

FatPipe WARP/IPVPN/MPVPN - Authorization Bypass Detection

FatPipe WARP, IPVPN, and MPVPN software prior to versions 10.1.2r60p91 and 10.2.2r42 contain a missing authorization caused by lack of access control in the web management interface, letting remote attackers access sensitive URLs, exploit requires no authentication. !/usr/bin/env python3 -- codin...

Ntopng Authentication Bypass Detection

Ntopng, a passive network monitoring tool, contains an authentication bypass vulnerability in ntopng = 4.2 !/usr/bin/env python3 -- coding: utf-8 -- """Ntopng, a passive network monitoring tool, contains an authentication bypass vulnerability in ntopng = 4.""" from kittysploit import from...

Joomla! ChronoForums 2.0.11 - Local File Inclusion Detection

Joomla! ChronoForums 2.0.11 avatar function is vulnerable to local file inclusion through unauthenticated path traversal attacks. This enables an attacker to read arbitrary files, for example the Joomla! configuration file which contains credentials. !/usr/bin/env python3 -- coding: utf-8 --...

VICIdial Sensitive Information Disclosure Detection

VICIdial's Web Client is susceptible to information disclosure because it contains many sensitive files that can be accessed from the client side. These files contain mysqli logs, auth logs, debug information, successful and unsuccessful login attempts with their corresponding IP's, User-Agents,...

LDAP Injection In OpenAM Detection

OpenAM contains an LDAP injection vulnerability. When a user tries to reset his password, they are asked to enter username, and then the backend validates whether the user exists or not through an LDAP query. If the user exists, the password reset token is sent to the user's email. Enumeration ca...

Nacos <1.4.1 - Authentication Bypass Detection

Nacos before version 1.4.1 is vulnerable to authentication bypass because the ConfigOpsController lets the user perform management operations like querying the database or even wiping it out. While the /data/remove endpoint is properly protected with the @Secured annotation, the /derby endpoint i...

Seo Panel 4.8.0 - Cross-Site Scripting Detection

Seo Panel 4.8.0 contains a reflected cross-site scripting vulnerability via the seo/seopanel/login.php?sec=forgot email parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Seo Panel 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

CentOS Web Panel - OS Command Injection Detection

The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability leading to root Remote Code Execution. !/usr/bin/env python3 -- coding: utf-8 -- """The unprivileged user portal part of CentOS Web Panel is affected by a Command Injection vulnerability...

BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting Detection

BeyondTrust Secure Remote Access Base through 6.0.1 contains a cross-site scripting vulnerability which allows remote attackers to inject arbitrary web script or HTML. !/usr/bin/env python3 -- coding: utf-8 -- """BeyondTrust Secure Remote Access Base through 6.""" from kittysploit import from...

Hitachi Vantara Pentaho/Business Intelligence Server - Authentication Bypass Detection

Hitachi Vantara Pentaho through 9.1 and Pentaho Business Intelligence Server through 7.x are vulnerable to authentication bypass. The Security Model has different layers of Access Control. One of these layers is the applicationContext security, which is defined in the...

WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection Detection

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...

Zoho ManageEngine OpManager < 12.5.329 - Remote Code Execution Detection

Zoho ManageEngine OpManager before 12.5.329 contains a remote code execution caused by a general bypass in the deserialization class, letting unauthenticated attackers execute arbitrary code, exploit requires no authentication !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine OpManag...

emlog 5.3.1 Path Disclosure Detection

emlog v5.3.1 is susceptible to full path disclosure via t/index.php, which allows an attacker to see the path to the webroot/file. !/usr/bin/env python3 -- coding: utf-8 -- """emlog v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient...

CommScope Ruckus IoT Controller - Information Disclosure Detection

CommScope Ruckus IoT Controller is susceptible to information disclosure vulnerabilities because a 'service details' API endpoint discloses system and configuration information to an attacker without requiring authentication. This information includes DNS and NTP servers that the devices use for...

Ruby Dragonfly <1.4.0 - Remote Code Execution Detection

Ruby Dragonfly before 1.4.0 contains an argument injection vulnerability that allows remote attackers to read and write to arbitrary files via a crafted URL when the verifyurl option is disabled. This may lead to code execution. The problem occurs because the generate and process features mishand...

Rstudio Shiny Server <1.5.16 - Local File Inclusion Detection

Rstudio Shiny Server prior to 1.5.16 is vulnerable to local file inclusion and source code leakage. This can be exploited by appending an encoded slash to the URL. !/usr/bin/env python3 -- coding: utf-8 -- """Rstudio Shiny Server prior to 1.""" import re from kittysploit import from...

MaxSite CMS > V106 - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/ allows remote attackers to inject arbitrary web script to a page." !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting vulnerability in MaxSite CMS before V106 via product/page/...

Thruk 2.40-2 - Cross-Site Scripting Detection

Thruk 2.40-2 contains a cross-site scripting vulnerability via /thruk/cgi-bin/status.cgi?style=combined&title=TITLE in the host or title parameter. An attacker can inject arbitrary JavaScript into status.cgi, leading to a triggered payload when accessed by an authenticated user. !/usr/bin/env...

Nova noVNC - Open Redirect Detection

Nova noVNC contains an open redirect vulnerability. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. !/usr/bin/env python3 -- coding: utf-8 -- """Nova noVNC contains an open redirect vulnerability."...

PrestaShop SmartBlog <4.0.6 - SQL Injection Detection

PrestaShop SmartBlog by SmartDataSoft 4.0.6 is vulnerable to a SQL injection vulnerability in the blog archive functionality. !/usr/bin/env python3 -- coding: utf-8 -- """PrestaShop SmartBlog by SmartDataSoft 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting Detection

Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on the loadframe page. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ADSelfService Plus 6103 and prior contains a reflected cross-site scripting vulnerability on.""" from...

Tiny Java Web Server - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting...

Gnuboard 5 - Cross-Site Scripting Detection

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter.""" from kittysploit import from lib.protocols.http.httpclient import...

ExponentCMS <= 2.6 - Host Header Injection Detection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. !/usr/bin/env python3 -- coding: utf-8 -- """An HTTP Host header attack exists in...

WordPress BulletProof Security 5.1 Information Disclosure Detection

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible /dbbackuplog.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up t...

EyouCMS 1.5.4 Open Redirect Detection

EyouCMS 1.5.4 is vulnerable to an Open Redirect vulnerability. An attacker can redirect a user to a malicious url via the Logout function. !/usr/bin/env python3 -- coding: utf-8 -- """EyouCMS 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure Detection

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink E1 Zoom Camera versions 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the username parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the mail parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

MKdocs 1.2.2 - Directory Traversal Detection

The MKdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain sensitive information. Note the vendor has disputed the vulnerability see references because the dev server must be used in an unsafe way namely public to have this...

ECOA Building Automation System - Arbitrary File Retrieval Detection

The ECOA BAS controller suffers from an arbitrary file disclosure vulnerability. Using the 'fname' POST parameter in viewlog.jsp, attackers can disclose arbitrary files on the affected device and disclose sensitive and system information. !/usr/bin/env python3 -- coding: utf-8 -- """The ECOA BAS...

Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting Detection

Microsoft Exchange Server is vulnerable to a spoofing vulnerability. Be aware this CVE ID is unique from CVE-2021-42305. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Server is vulnerable to a spoofing vulnerability.""" from kittysploit import from lib.protocols.http.httpclient...

i-Panel Administration System 2.0 - Cross-Site Scripting Detection

i-Panel Administration System 2.0 contains a cross-site scripting vulnerability that enables an attacker to execute arbitrary JavaScript code in the browser-based web console. !/usr/bin/env python3 -- coding: utf-8 -- """i-Panel Administration System 2.""" from kittysploit import from...

myfactory FMS - Cross-Site Scripting Detection

myfactory.FMS before 7.1-912 allows cross-site scripting via the UID parameter. !/usr/bin/env python3 -- coding: utf-8 -- """myfactory.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myfactory FMS - Cross-Site...

Fortinet FortiMail 7.0.1 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in FortiMail may allow an unauthenticated attacker to perform an attack via specially crafted HTTP GET requests to the FortiGuard URI protection service. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in FortiMail may allow a...

AlquistManager Local File Inclusion Detection

AlquistManager branch as of commit 280d99f43b11378212652e75f6f3159cde9c1d36 is affected by a directory traversal vulnerability in alquist/IO/input.py. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access...

Clustering Local File Inclusion Detection

Clustering master branch as of commit 53e663e259bcfc8cdecb56c0bb255bd70bfcaa70 is affected by a directory traversal vulnerability. This attack can cause the disclosure of critical secrets stored anywhere on the system and can significantly aid in getting remote code access. !/usr/bin/env python3 ...

Reprise License Manager 14.2 - Authentication Bypass Detection

Reprise License Manager RLM 14.2 does not verify authentication or authorization and allows unauthenticated users to change the password of any existing user. !/usr/bin/env python3 -- coding: utf-8 -- """Reprise License Manager RLM 14.""" from kittysploit import from lib.protocols.http.httpclient...

WAVLINK AC1200 - Information Disclosure Detection

A vulnerability is in the 'livemfg.html' page of the WAVLINK AC1200, version WAVLINK-A42W-1.27.6-20180418, which can allow a remote attacker to access this page without any authentication. When processed, it exposes some key information of the manager of router. !/usr/bin/env python3 -- coding:...