WordPress Visualizer <3.3.1 - Cross-Site Scripting Detection

WordPress Visualizer plugin before 3.3.1 contains a stored cross-site scripting vulnerability via /wp-json/visualizer/v1/update-chart WP-JSON API endpoint. An unauthenticated attacker can execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard...

Metinfo 7.0.0 beta - SQL Injection Detection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/product/admin/productadmin.class.php via the admin/?n=product&c=productadmin&a=dopara&apptype=shop id parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Metinfo 7.""" from kittysploit import from lib.protocols.http.httpclient...

Metinfo 7.0.0 beta - SQL Injection Detection

Metinfo 7.0.0 beta is susceptible to SQL Injection in app/system/language/admin/languagegeneral.class.php via the admin/?n=language&c=languagegeneral&a=doExportPack appno parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Metinfo 7.""" from kittysploit import from lib.protocols.http.httpclie...

WordPress <= 5.2.4 - Unauthenticated View Private/Draft Posts Detection

WordPress before 5.2.4 contains an information disclosure caused by mishandling of the static query property, letting unauthenticated users view certain content, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress before 5.""" import re from kittysploit impo...

Huawei Firewall - Local File Inclusion Detection

USG9500 with versions of V500R001C30SPC100, V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, V500R005C00SPC100, V500R005C00SPC200 have an information leakage vulnerability. Due to improper processing of the initialization vector used in a specific encryption algorithm, an attacker who gai...

WordPress Email Subscribers & Newsletters <4.2.3 - Arbitrary File Retrieval Detection

WordPress Email Subscribers & Newsletters plugin before 4.2.3 is susceptible to arbitrary file retrieval via a flaw that allows unauthenticated file download and user information disclosure. An attacker can obtain sensitive information, modify data, and/or execute unauthorized administrative...

WordPress Advanced Access Manager - Path Traversal Detection

The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to insufficient validation on the aam-media parameter. This allows unauthenticated attackers to read any file on the server, including sensitive file...

IBM BigFix Platform - Information Disclosure Detection

IBM BigFix Platform 9.2 and 9.5 contains an information disclosure vulnerability caused by not enabling authenticated access in relay, letting remote attackers query and gather update and fixlet information, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-8 -- """IBM BigF...

WordPress Ad Inserter <2.7.10 - Cross-Site Scripting Detection

WordPress Ad Inserter plugin before 2.7.10 contains a cross-site scripting vulnerability. It does not sanitize and escape the htmlelementselection parameter before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Ad Inserter plugin before 2.""" from kittysplo...

Microweber < 1.2.11 - Open Redirection Detection

Open Redirect in Packagist microweber/microweber prior to 1.2.11. !/usr/bin/env python3 -- coding: utf-8 -- """Open Redirect in Packagist microweber/microweber prior to 1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...

uDraw <3.3.3 - Local File Inclusion Detection

uDraw before 3.3.3 does not validate the url parameter in its udrawconverturltobase64 AJAX action available to both unauthenticated and authenticated users before using it in the filegetcontents function and returning its content base64 encoded in the response. As a result, unauthenticated users...

Rudloff alltube prior to 3.0.1 - Open Redirect Detection

An open redirect vulnerability exists in Rudloff/alltube that could let an attacker construct a URL within the application that causes redirection to an arbitrary external domain via Packagist in versions prior to 3.0.1. !/usr/bin/env python3 -- coding: utf-8 -- """An open redirect vulnerability...

WordPress WPQA <5.5 - Improper Access Control Detection

WordPress WPQA plugin before 5.5 is susceptible to improper access control. The plugin lacks authentication in a REST API endpoint. An attacker can potentially discover private questions sent between users on the site. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WPQA plugin before 5.""...

WordPress Gallery <2.0.0 - Cross-Site Scripting Detection

WordPress Gallery plugin before 2.0.0 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, available to both unauthenticated and authenticated users. !/usr/bin/env python3 -- coding: utf-8...

Juniper Web Device Manager - Cross-Site Scripting Detection

Juniper Web Device Manager J-Web in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal...

MeterSphere < 2.5.0 SSRF Detection

MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions prior to 2.5.0 are subject to a Server-Side Request Forgery that leads to Cross-Site Scripting. A Server-Side request forgery in...

WordPress Simply Schedule Appointments <1.5.7.7 - Information Disclosure Detection

WordPress Simply Schedule Appointments plugin before 1.5.7.7 is susceptible to information disclosure. The plugin is missing authorization in a REST endpoint, which can allow an attacker to retrieve user details such as name and email address. !/usr/bin/env python3 -- coding: utf-8 -- """WordPres...

Pulse Connect Secure SSL VPN Arbitrary File Read Detection

Pulse Secure Pulse Connect Secure PCS 8.2 before 8.2R12.1, 8.3 before 8.3R7.1, and 9.0 before 9.0R3.4 all contain an arbitrary file reading vulnerability that could allow unauthenticated remote attackers to send a specially crafted URI to gain improper access. !/usr/bin/env python3 -- coding: utf...

Cisco Small Business WAN VPN Routers - Sensitive Information Disclosure Detection

Cisco Small Business RV320 and RV325 Dual Gigabit WAN VPN Routers could allow an unauthenticated remote attacker to retrieve sensitive information due to improper access controls for URLs. An attacker could exploit this vulnerability by connecting to an affected device via HTTP or HTTPS and...

Apache Struts 2.0.0-2.5.25 - Remote Code Execution Detection

Apache Struts 2.0.0 through Struts 2.5.25 is susceptible to remote code execution because forced OGNL evaluation, when evaluated on raw user input in tag attributes, may allow it. !/usr/bin/env python3 -- coding: utf-8 -- """Apache Struts 2.""" import re from kittysploit import from...

Nette Framework - Remote Code Execution Detection

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. !/usr/bin/env python3 -- coding: utf-8 -- """Nette Framework versions before...

FortiWeb - Cross Site Scripting Detection

FortiWeb 6.3.0 through 6.3.7 and versions before 6.2.4 contain an unauthenticated cross-site scripting vulnerability. Improper neutralization of input during web page generation can allow a remote attacker to inject malicious payload in vulnerable API end-points. !/usr/bin/env python3 -- coding:...

D-Link DIR850 ET850-1.08TRb03 - Open Redirect Detection

DLink DIR850 ET850-1.08TRb03 contains incorrect access control vulnerability in URL redirection, which can be used to mislead users to go to untrusted sites. !/usr/bin/env python3 -- coding: utf-8 -- """DLink DIR850 ET850-1.""" import re from kittysploit import from lib.protocols.http.httpclient...

GeoServer <1.2.2 - Remote Code Execution Detection

Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22...

TOTOLINK A3700R - Command Injection Detection

An issue in TOTOLINK A3700R v.9.1.2u.616520211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in TOTOLINK A3700R v.""" import re from kittysploit import from...

Netis Wifi Router - Information Disclosure Detection

An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi Router MW5360 1.0.1.3442 and 1.0.1.3031 allows a...

Brother MFC-L9570CDW - Information Disclosure Detection

An unauthenticated attacker who can access either the HTTP service TCP port 80, the HTTPS service TCP port 443, or the IPP service TCP port 631, can leak several pieces of sensitive information from a vulnerable device. The URI path /etc/mntinfo.csv can be accessed via a GET request and no...

XWiki Platform - Remote Code Execution Detection

Any guest can perform arbitrary remote code execution through a request to SolrSearch. This impacts the confidentiality, integrity, and availability of the whole XWiki installation. This vulnerability has been patched in XWiki 15.10.11, 16.4.1, and 16.5.0RC1. !/usr/bin/env python3 -- coding: utf-...

Fortinet FortiWeb - SQL Injection Detection

An improper neutralization of special elements used in an SQL command 'SQL Injection' vulnerability CWE-89 in FortiWeb may allow an unauthenticated attacker to execute unauthorized SQL code or commands via crafted HTTP or HTTPS requests. !/usr/bin/env python3 -- coding: utf-8 -- """An improper...

Flowise - NVIDIA NIM Endpoints Missing Authentication Detection

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router /api/v1/nvidia-nim/ is whitelisted in the global authentication middleware, allowing unauthenticated access to privileged container management and token generati...

phpVMS < 7.0.6 - Legacy Importer Authorization Bypass Detection

phpVMS 7.0.6 contains an authentication bypass caused by unauthenticated access to a legacy import feature, letting unauthenticated attackers access restricted functionality, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """phpVMS 7.""" from kittysploit import...

Progress ADC LoadMaster - Command Injection

Unauthenticated OS command injection in Progress ADC LoadMaster /accessv2 API. !/usr/bin/env python3 -- coding: utf-8 -- """Progress ADC LoadMaster - Command Injection""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name":...

Palo Alto GlobalProtect CVE-2024-3400 Detection

Detects CVE-2024-3400 in Palo Alto Networks PAN-OS GlobalProtect by confirming the SESSID path-traversal file-create canary 404 then 403. !/usr/bin/env python3 -- coding: utf-8 -- """Palo Alto GlobalProtect CVE-2024-3400 path traversal / RCE detection.""" import secrets from kittysploit import fr...

SAP NetWeaver CVE-2025-31324 Detection

Detects unauthenticated access to SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-31324 without uploading a malicious payload. !/usr/bin/env python3 -- coding: utf-8 -- """SAP NetWeaver Visual Composer CVE-2025-31324 unauth metadata uploader detection.""" from kittysploit import from...

XWiki < 14.10.14 - Cross-Site Scripting Detection

XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name of the...

Metabase Login Panel - Detect

Metabase login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Metabase login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Metabase Login Panel - Detect', 'description':...

Apache NiFi - Unauthenticated Access Detection

Apache NiFi server was able to be accessed because no authentication was required. !/usr/bin/env python3 -- coding: utf-8 -- """Apache NiFi server was able to be accessed because no authentication was required.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Webmin <= 1.920 - Unauthenticated Remote Command Execution Detection

Webmin =1.920. is vulnerable to an unauthenticated remote command execution via the parameter 'old' in passwordchange.cgi. !/usr/bin/env python3 -- coding: utf-8 -- """Webmin =1.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Apache Hadoop YARN ResourceManager - Unauthenticated API Detection

Apache Hadoop YARN ResourceManager is susceptible to remote code execution. An attacker can execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Apache...

Samsung WLAN AP WEA453e - Remote Code Execution Detection

Samsung WLAN AP WEA453e is vulnerable to a pre-auth root remote command execution vulnerability, which means an attacker could run code as root remotely without logging in. !/usr/bin/env python3 -- coding: utf-8 -- """Samsung WLAN AP WEA453e is vulnerable to a pre-auth root remote command executi...

ThinkPHP 5.0.23 - Remote Code Execution Detection

An issue was discovered in NoneCms V1.3. thinkphp/library/think/App.php allows remote attackers to execute arbitrary PHP code via crafted use of the filter parameter, as demonstrated by the s=index/\think\Request/input&filter=phpinfo&data=1 query string. !/usr/bin/env python3 -- coding: utf-8 --...

Zeroshell 3.9.0 - Remote Command Execution Detection

Zeroshell 3.9.0 is prone to a remote command execution vulnerability. Specifically, this issue occurs because the web application mishandles a few HTTP parameters. An unauthenticated attacker can exploit this issue by injecting OS commands inside the vulnerable parameters. !/usr/bin/env python3 -...

Citrix ADC and Gateway - Directory Traversal Detection

Citrix Application Delivery Controller ADC and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0 are susceptible to directory traversal vulnerabilities. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix Application Delivery Controller ADC and Gateway 10.""" from kittysploit import from...

TVT NVMS 1000 - Local File Inclusion Detection

TVT NVMS-1000 devices allow GET /.. local file inclusion attacks. !/usr/bin/env python3 -- coding: utf-8 -- """TVT NVMS-1000 devices allow GET /.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TVT NVMS 100...

Kyocera Printer d-COPIA253MF - Directory Traversal Detection

Kyocera Printer d-COPIA253MF plus is susceptible to a directory traversal vulnerability which could allow an attacker to retrieve or view arbitrary files from the affected server. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera Printer d-COPIA253MF plus is susceptible to a directory traversa...

Buffalo WSR-2533DHPL2 - Path Traversal Detection

Buffalo WSR-2533DHPL2 firmware version = 1.02 and WSR-2533DHP3 firmware version = 1.24 are susceptible to a path traversal vulnerability that could allow unauthenticated remote attackers to bypass authentication in their web interfaces. !/usr/bin/env python3 -- coding: utf-8 -- """Buffalo...

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution Detection

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP befor...

Ivanti EPM Cloud Services Appliance Code Injection Detection

Ivanti EPM Cloud Services Appliance CSA before version 4.6.0-512 is susceptible to a code injection vulnerability because it allows an unauthenticated user to execute arbitrary code with limited permissions nobody. !/usr/bin/env python3 -- coding: utf-8 -- """Ivanti EPM Cloud Services Appliance C...

D-Link DAP-1620 - Local File Inclusion Detection

D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can lead to unauthorized internal files reading /etc/passwd and /etc/shadow. !/usr/bin/env python3 -- coding: utf-8 -- """D-Link DAP-1620 is susceptible to local file Inclusion due to path traversal that can lead to...

Sophos Firewall <=18.5 MR3 - Remote Code Execution Detection

Sophos Firewall version v18.5 MR3 and older contains an authentication bypass vulnerability in the User Portal and Webadmin which could allow a remote attacker to execute code. !/usr/bin/env python3 -- coding: utf-8 -- """Sophos Firewall version v18.""" from kittysploit import from...