Linksys E2000 1.0.06 position.js Improper Authentication Detection

Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. !/usr/bin/env python3 -- coding: utf-8 -- """Linksys E2000 Ver.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Linksy...

Unauthenticated Popup File Upload - Detect

Endpoints where files can be uploaded without authentication were detected. !/usr/bin/env python3 -- coding: utf-8 -- """Endpoints where files can be uploaded without authentication were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Copyparty <=1.18.6 - Cross-Site Scripting Detection

Copyparty before 1.18.7 is vulnerable to reflected cross-site scripting XSS via the 'filter' parameter in the '/?ru' endpoint. Unsanitized user input is reflected in the HTML response, allowing attackers to execute arbitrary JavaScript in the context of the victim's browser. !/usr/bin/env python3...

Balada Injector Malware - Detect

Checks websites for Balada Injector malware. !/usr/bin/env python3 -- coding: utf-8 -- """Checks websites for Balada Injector malware.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Balada Injector Malware...

Drupal - Remote Code Execution Detection

Drupal before 7.58, 8.x before 8.3.9, 8.4.x before 8.4.6, and 8.5.x before 8.5.1 allows remote attackers to execute arbitrary code because of an issue affecting multiple subsystems with default or common module configurations. !/usr/bin/env python3 -- coding: utf-8 -- """Drupal before 7.""" impor...

Jetty Default Page Detection

Detects Jetty Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jetty Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jetty Default Page Detection', 'description': 'Detects Jetty Defaul...

Hue Personal Wireless Lighting - Detect

This template detects the presence of Hue Personal Wireless Lighting systems by looking for specific welcome messages in the response. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects the presence of Hue Personal Wireless Lighting systems by looking for specific welcome m.""" fr...

WebMvc.fn/WebFlux.fn - Path Traversal Detection

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure Detection

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. !/usr/bin/env python3 -- coding: utf-8 -- """WordPres...

Cleo Technology - Detect

This template detects Cleo technologies, including VLTrader, Harmony, and LexiCom, by inspecting response headers.It also extracts version information for each identified technology. !/usr/bin/env python3 -- coding: utf-8 -- """This template detects Cleo technologies, including VLTrader, Harmony,...

STAGIL Navigation for Jira Menu & Themes <2.0.52 - Local File Inclusion Detection

STAGIL Navigation for Jira Menu & Themes plugin before 2.0.52 is susceptible to local file inclusion via modifying the fileName parameter to the snjFooterNavigationConfig endpoint. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site...

CX Cloud Panel - Detect

CX Cloud panel was detected, !/usr/bin/env python3 -- coding: utf-8 -- """CX Cloud panel was detected,.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CX Cloud Panel - Detect', 'description': 'CX Cloud panel was...

XWiki Platform - Information Disclosure Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is a generic wiki platform...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass

Kentico Staging SyncServer accepts UsernameToken without password WT-2025-0011. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging Service Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion Detection

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Karel IP Phone IP1211 Web...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation Detection

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. !/usr/bin/env python3 -- coding: utf-8 -- """Zoom WordPress plugin 4.""" from...

Letta 0.7.12 - Remote Code Execution

Unauthenticated RCE via POST /v1/tools/run executing attacker tool sourcecode. !/usr/bin/env python3 -- coding: utf-8 -- """Letta 0.7.12 - Remote Code Execution""" import hashlib import json from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

FOSSBilling - Server-Side Template Injection

FOSSBilling stringrender API evaluates unsandboxed Twig, allowing SQL/info disclosure via guest.getDi.db.getCell. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling - Server-Side Template Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

NocoDB < 0.258.0 - Reflected XSS in Password Reset Detection

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. !/usr/bin/env...

EOS HTTP Browser Detection

Detects EOS HTTP Browser. !/usr/bin/env python3 -- coding: utf-8 -- """Detects EOS HTTP Browser.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EOS HTTP Browser Detection', 'description': 'Detects EOS HTTP Browser.'...

OpenLLM Panel - Detect

OpenLLM is an open-source platform for running and deploying LLMs in production. It is built by BentoML and provides an OpenAI-compatible API server with a web UI for model management. !/usr/bin/env python3 -- coding: utf-8 -- """OpenLLM is an open-source platform for running and deploying LLMs i...

Koha 3.20.1 - Directory Traversal Detection

Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f dot dot encoded slash in the templatepath parameter to 1 svc/virtualshelves/search or 2 svc/members/search. !/usr/bin/env python3 -- coding...

My Geo Posts Free <= 1.2 - PHP Object Injection Detection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

CData Arc < 23.4.8839 - Path Traversal Detection

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Veeam Backup & Replication - Unauthenticated Detection

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. !/usr/bin/env python3 -- coding: utf-8 -- """A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote.""" from...

Etcd Version - Detect

Template detects Etcd version. !/usr/bin/env python3 -- coding: utf-8 -- """Template detects Etcd version.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Etcd Version - Detect', 'description': 'Template detects Etcd...

IBM Maximo Asset Management Information Disclosure - XML External Entity Injection Detection

IBM Maximo Asset Management is vulnerable to an XML external entity injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. !/usr/bin/env python3 -- coding: utf-8 -- """IBM Maximo Asset Manageme...

Bazarr < 1.4.3 - Arbitrary File Read Detection

Bazarr 1.4.3 and earlier versions have a arbitrary file read vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Bazarr 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Bazarr 1.4.3 - Arbitrary Fi...

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution Detection

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 for Time Clock and 1.1.4 for Time Clock Pro via the 'etimeclockwploadfunctioncallback' function. This allows unauthenticated attackers to execute code on t...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) Detection

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

ThinkPHP 5.0.9 - Information Disclosure Detection

ThinkPHP 5.0.9 includes verbose SQL error message that can reveal sensitive information including database credentials. !/usr/bin/env python3 -- coding: utf-8 -- """ThinkPHP 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Wordpress Profile Builder Plugin Cross-Site Scripting Detection

The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to cross-site scripting due to insufficient escaping and sanitization of the siteurl parameter found in the /assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a...

WordPress Real Estate 7 Theme <= 3.3.4 - Cross-Site Scripting Detection

The Real Estate 7 premium theme for WordPress is vulnerable to Reflected Cross-Site Scripting XSS attack vector in versions up to, and including, v3.3.4 via the 'ctadditionalfeatures' option due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated...

Member Hero <=1.0.9 - Remote Code Execution Detection

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

Reprise License Manager 14.2 - Information Disclosure Detection

Reprise License Manager 14.2 is susceptible to information disclosure via a GET request to /goforms/rlminfo. No authentication is required. The information disclosed is associated with software versions, process IDs, network configuration, hostnames, system architecture and file/directory...

Sharp Multifunction Printers - Cookie Exposure Detection

It was observed that Sharp printers are vulnerable to a listing of session cookies without authentication. Any attacker can list valid cookies by visiting a backdoor webpage and use them to authenticate to the printers. !/usr/bin/env python3 -- coding: utf-8 -- """It was observed that Sharp...

Zentral Panel - Detect

Zentral panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zentral panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zentral Panel - Detect', 'description': 'Zentral panel was...

Zebra Printer Detect

Zebra Printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zebra Printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zebra Printer Detect', 'description': 'Zebra Printer...

BGP Detection

The remote host is running BGP, a popular routing protocol. This indicates that the remote host is probably a network router. !/usr/bin/env python3 -- coding: utf-8 -- """The remote host is running BGP, a popular routing protocol.""" import socket from kittysploit import from...

ZTE Panel - Detect

ZTE panel was detected. ZTE Corporation is a global leader in telecommunications and information technology. Founded in 1985 and listed on both the Hong Kong and Shenzhen Stock Exchanges, the company has been committed to providing innovative technologies and integrated solutions for global...

XWiki Platform - Unauthorized Document History Access Detection

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

CyberPower - SQL Injection Detection

A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.8.3. !/usr/bin/env python3 -- coding: utf-8 -- """A sql injection vulnerability exists in CyberPower PowerPanel Enterprise prior to v2.""" from kittysploit import from lib.protocols.http.httpclient import...

iTop - User Enumeration via REST Endpoint Detection

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. !/usr/bin/env python3 -- coding: utf-8 --...

LumisXP - Cross-site Scripting Detection

A cross-site scripting XSS vulnerability in the XsltResultControllerHtml.jsp component of LumisXP v15.0.x to v16.1.x allows attackers to execute arbitrary web scripts or HTML via the lumPageID parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting XSS vulnerability in the...

MasterSAM Star Gate v11 - Local File Inclusion Detection

MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure Detection

A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is...

Drupal 11.x-dev - Full Path Disclosure Detection

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. !/usr/bin/env python3 -- coding: utf-8 -- """core/authorize.""" from kittysploit import from lib.protocols.http.httpclient...

PrivateGPT < 0.5.0 - Open Redirect Detection

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. !/usr/bin/env python3 -- codin...

Checkmk Agent Info Disclosure Detection

The Checkmk agent had exposed sensitive system information on TCP port 6556 without requiring authentication. !/usr/bin/env python3 -- coding: utf-8 -- """The Checkmk agent had exposed sensitive system information on TCP port 6556 without requiring authentication.""" import socket from kittysploi...

WordPress Storefront Theme - Full Path Disclosure Detection

The Storefront theme for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Storefront theme...