HPE OneView - Panel Detect

HPE OneView is an infrastructure management platform that provides automated management, monitoring, and updates for HPE servers, storage, and networking resources through a unified interface. !/usr/bin/env python3 -- coding: utf-8 -- """HPE OneView is an infrastructure management platform that...

Netsparker Enterprise Installer Detection

Netsparker Enterprise is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Netsparker Enterprise is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclien...

Inductive Automation Ignition - Gateway Panel Detection

Inductive Automation Ignition is a widely-deployed industrial SCADA/HMI platform used in manufacturing, utilities, and process industries. The Ignition Gateway web interface provides access to project management, OPC-UA tag browsing, and system configuration. Exposed gateways may allow...

Monsta FTP - Detect

Detects Monsta FTP web-based file manager interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Monsta FTP web-based file manager interface.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Monsta FTP -...

Hanming Video Conferencing - Local File Inclusion Detection

Hanming Video Conferencing is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """Hanming Video Conferencing is vulnerable to local file inclusion.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclien...

Hoppscotch Panel - Detect

Hoppscotch panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Hoppscotch panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Hoppscotch Panel - Detect', 'description': 'Hoppscotch...

Netsweeper - Authentication Bypass Detection

The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL. !/usr/bin/env python3 -- coding: utf-8 -- """The Client Filt...

Joomla! Component com_jvideodirect - Directory Traversal Detection

Directory traversal vulnerability in the jVideoDirect comjvideodirect component for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """Directory traversal vulnerability in the jVideoDirect...

Helm Dashboard - Exposure Detection

Detects Helm Dashboard - Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Helm Dashboard - Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Helm Dashboard - Exposure Detection', 'description':...

Reflected XSS - Telerik Reporting Module Detection

Cross-site scripting vulnerability in Telerik.ReportViewer.WebForms.dll in Telerik Reporting for ASP.NET WebForms Report Viewer control before R1 2017 SP2 11.0.17.406 allows remote attackers to inject arbitrary web script or HTML via the bgColor parameter to Telerik.ReportViewer.axd. !/usr/bin/en...

SphinxOnline Panel - Detect

SphinxOnline Login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SphinxOnline Login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SphinxOnline Panel - Detect', 'description':...

Jupyter Lab - Unauthenticated Access Detection

JupyterLab was able to be accessed without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """JupyterLab was able to be accessed without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jupyt...

SuiteCRM Installer Exposure Detection

SuiteCRM is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """SuiteCRM is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Symfony Lock File - Exposure Detection

symfony.lock was found accessible, exposing a full list of installed Composer packages, library versions, and metadata for a Symfony-based PHP application. Disclosure of this file can provide insight into the application's attack surface, potentially revealing vulnerable or outdated dependencies...

WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure Detection

The 3D FlipBook WordPress plugin ≤ v1.16.17 has a vulnerability where an unauthenticated AJAX action fb3dsendposts exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization. !/usr/bin/env...

Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect Detection

The plugin is vulnerable to Open Redirect due to insufficient validation on the redirect oauth2callback.php file. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. !/usr/bin/env...

WordPress Plugin Safe SVG - Full Path Disclosure Detection

WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Safe SVG plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

YPAREO Panel - Detect

YPAREO was detected — an Enterprise Resource Planning system. !/usr/bin/env python3 -- coding: utf-8 -- """YPAREO was detected — an Enterprise Resource Planning system.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Wuzhicms Detected

Wuzhicms was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Wuzhicms was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wuzhicms Detected', 'description': 'Wuzhicms was detected.', 'author':...

CirCarLife Scada <4.3 - System Log Exposure Detection

CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI. CirCarLife is an internet-connected electric vehicle charging station. !/usr/bin/env python3 -- coding: utf-8 -- """CirCarLife Scada before...

Clockwork Dashboard Exposure Detection

Clockwork Dashboard is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Clockwork Dashboard is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Clockwork Dashboard Exposure Detection', 'description':...

Versa Analytics Server Detection

Detects Versa Analytics Server Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Versa Analytics Server Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Versa Analytics Server Detection',...

JD FTP Service - Detect

JD FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """JD FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'JD FTP Service - Detect',...

iTop Hub Connector - Information Disclosure Detection

Combodo iTop is a simple, web based IT Service Management tool. Server, OS, DBMS, PHP, and iTop info name, version and parameters can be read by anyone having access to iTop URI. This issue has been patched in versions 2.7.11, 3.0.5, 3.1.2, and 3.2.0. !/usr/bin/env python3 -- coding: utf-8 --...

Symfony Profiler - Remote Access via Injected Arguments Detection

symfony/runtime is a module for the Symphony PHP framework which enables decoupling PHP applications from global state. When the registerargvargc php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment or debug mode used by...

Joomla! Component Foobla Suggestions 1.5.1.2 - Local File Inclusion Detection

A directory traversal vulnerability in the Foobla Suggestions comfooblasuggestions component 1.5.1.2 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory...

Synopsys Coverity Panel Detection

Coverity® is a fast, accurate, and highly scalable static analysis SAST solution that helps development and security teams address security and quality defects early in the software development life cycle SDLC, track and manage risks across the application portfolio, and ensure compliance with...

Adobe AEM CRX Namespace Editor Exposure Detection

Adobe AEM CRX Namespace Editor is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Adobe AEM CRX Namespace Editor is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Adobe AEM CRX Namespace Editor Exposu...

WordPress Plugin CodeArt Google MP3 Player - File Disclosure Download Detection

WordPress Plugin CodeArt Google MP3 Player allows an unauthenticated attacker to download file from server. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CodeArt Google MP3 Player allows an unauthenticated attacker to download file from server.""" from kittysploit import from...

Pi-hole Reflected XSS in 404-Error Page Detection

Pi-hole Admin Interface = 6.2.1 contains a reflected XSS vulnerability on the 404 error page. The URL path is reflected unsanitized into the class attribute of the body tag, allowing attribute injection via a crafted URL to execute arbitrary JavaScript in victim browsers. !/usr/bin/env python3 --...

Netflow Analyzer Login - Panel Detection

Detects Netflow Analyzer Login - Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Netflow Analyzer Login - Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Netflow Analyzer Login - Panel Detection',...

Actifio Resource Center - Panel Detection

Actifio Resource Center was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Actifio Resource Center was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Actifio Resource Center - Panel Detection',...

Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion Detection

A directory traversal vulnerability in the AlphaUserPoints comalphauserpoints component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the view parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Teltonika Login Panel - Detect

Teltonika login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Teltonika login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Teltonika Login Panel - Detect',...

Academy Learning Management System <5.9.1 - Cross-Site Scripting Detection

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Ncomputing vSPace Pro 10 and 11 - Directory Traversal Detection

Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Ncomputing vSpace Pro versions 10 and 11 suffer from a directory traversal vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import...

Academy LMS 6.2 - Cross-Site Scripting Detection

A vulnerability was found in Academy LMS 6.2 on Windows. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /academy/tutor/filter of the component GET Parameter Handler. The manipulation of the argument...

Adobe ColdFusion - Cross-Site Scripting Detection

Adobe ColdFusion debug page contains a cross-site scripting vulnerability when the application is running on a remote host. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

DomPHP 0.83 - Directory Traversal Detection

A directory traversal vulnerability in DomPHP 0.83 and earlier allows remote attackers to have unspecified impacts via a .. dot dot in the url parameter to photoalbum/index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in DomPHP 0.""" import re from...

Joomla! Component jesectionfinder - Local File Inclusion Detection

A directory traversal vulnerability in the JExtensions JE Section/Property Finder jesectionfinder component for Joomla! allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the view parameter to index.php. !/usr/bin/env python3 -- coding: utf-8...

Phoenix Framework - Open Redirect Detection

Phoenix Framework versions 1.0.0 through 1.0.4, 1.1.0 through 1.1.6, 1.2.0, 1.2.2 and 1.3.0-rc.0 contain an open redirect vulnerability, which may result in phishing or social engineering attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Phoenix Framework versions 1.""" import re from...

WordPress 99 Robots WP Background Takeover Advertisements <=4.1.4 - Local File Inclusion Detection

WordPress 99 Robots WP Background Takeover Advertisements 4.1.4 is susceptible to local file inclusion via exports/download.php. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress 99 Robots WP Background Takeover Advertisements 4.""" from kittysploit import from lib.protocols.http.httpclient...

Jira Service Desk Login Panel - Detect

Jira Service Desk login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Jira Service Desk login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jira Service Desk Login Panel -...

WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...

Wordpress Brandfolder - Remote/Local File Inclusion Detection

WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote server and disclose their content. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Brandfolder allows remote attackers to access arbitrary files that reside on the local and remote...

Noptin < 1.6.5 - Open Redirect Detection

Noptin 1.6.5 is susceptible to an open redirect vulnerability. The plugin does not validate the "to" parameter before redirecting the user to its given value, leading to an open redirect issue. !/usr/bin/env python3 -- coding: utf-8 -- """Noptin 1.""" import re from kittysploit import from...

MonstraCMS Detection

Detects MonstraCMS Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects MonstraCMS Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MonstraCMS Detection', 'description': 'Detects MonstraCMS...

PHP IPAM Installation Page - Exposed Detection

PHP IPAM is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """PHP IPAM is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

VMware Horizon Login Panel - Detect

VMware Horizon login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """VMware Horizon login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'VMware Horizon Login Panel -...

Dashy <= 4.3.6 - Reflected XSS via Workspace Detection

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...