Jeecg Boot <= 2.4.5 - Sensitive Information Disclosure Detection

Jeecg Boot = 2.4.5 API interface has unauthorized access and leaks sensitive information such as email,phone and Enumerate usernames that exist in the system. !/usr/bin/env python3 -- coding: utf-8 -- """Jeecg Boot = 2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclie...

Tiny Java Web Server - Cross-Site Scripting Detection

A reflected cross-site scripting vulnerability in the web server TTiny Java Web Server and Servlet Container TJWS =1.115 allows an adversary to inject malicious code on the server's "404 Page not Found" error page. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting...

phpfastcache - phpinfo Resource Exposure Detection

phpinfo is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastcache. !/usr/bin/env python3 -- coding: utf-8 -- """phpinfo is susceptible to resource exposure in unprotected composer vendor folders via phpfastcache/phpfastc.""" from kittysploit import...

Gnuboard 5 - Cross-Site Scripting Detection

Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Gnuboard 5 contains a cross-site scripting vulnerability via the $GET'LGDOID' parameter.""" from kittysploit import from lib.protocols.http.httpclient import...

ExponentCMS <= 2.6 - Host Header Injection Detection

An HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponentconstants.php. A modified HTTP header can change links on the webpage to an arbitrary value,leading to a possible attack vector for MITM. !/usr/bin/env python3 -- coding: utf-8 -- """An HTTP Host header attack exists in...

Grafana Snapshot - Authentication Bypass Detection

Grafana instances up to 7.5.11 and 8.1.5 allow remote unauthenticated users to view the snapshot associated with the lowest database key by accessing the literal paths /api/snapshot/:key or /dashboard/snapshot/:key. If the snapshot is in public mode, unauthenticated users can delete snapshots by...

WordPress BulletProof Security 5.1 Information Disclosure Detection

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible /dbbackuplog.txt file which grants attackers the full path of the site, in addition to the path of database backup files. This affects versions up t...

Reolink E1 Zoom Camera <=3.0.0.716 - Private Key Disclosure Detection

Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key RSA disclosure vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink E1 Zoom Camera versions 3.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner...

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the firstname parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

Metabase - Local File Inclusion Detection

Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map admin-settings-maps-custom maps-add a map support and potential local file inclusion including environment variables. URLs were not...

ECOA Building Automation System - Directory Traversal Content Disclosure Detection

The ECOA BAS controller suffers from a directory traversal content disclosure vulnerability. Using the GET parameter cpath in File Manager fmangersub, attackers can disclose directory content on the affected device !/usr/bin/env python3 -- coding: utf-8 -- """The ECOA BAS controller suffers from ...

PuneethReddyHC action.php SQL Injection Detection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping through the /action.php prId parameter. Using a post request does not sanitize the user input. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated SQL injection vulnerability exists in PuneethReddy...

PuneethReddyHC Online Shopping System homeaction.php SQL Injection Detection

An unauthenticated SQL injection vulnerability exists in PuneethReddyHC Online Shopping System through the /homeaction.php catid parameter. Using a post request does not sanitize the user input. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated SQL injection vulnerability exists in...

GitLab GraphQL API User Enumeration Detection

An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, names, and email addresses. !/usr/bin/env python3 -- coding: utf-8 -- """An unauthenticated remote attacker can leverage this vulnerability to collect registered GitLab usernames, nam.""" fr...

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting Detection

SAP Knowledge Warehouse 7.30, 7.31, 7.40, and 7.50 contain a reflected cross-site scripting vulnerability via the usage of one SAP KW component within a web browser. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Knowledge Warehouse 7.""" from kittysploit import from lib.protocols.http.httpclie...

D-Link DIR-615 - Unauthorized Access Detection

D-Link DIR-615 devices with firmware 20.06 are susceptible to unauthorized access. An attacker can access the WAN configuration page wan.htm without authentication, which can lead to disclosure of WAN settings, data modification, and/or other unauthorized operations. !/usr/bin/env python3 --...

Atmail 6.5.0 - Cross-Site Scripting Detection

Atmail 6.5.0 contains a cross-site scripting vulnerability in WebAdmin Control Pane via the format parameter to the default URI, which allows remote attackers to inject arbitrary web script or HTML via the “format” parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Atmail 6.""" from...

Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) Detection

There is a Cross Site Scripting XSS vulnerability in SpotPagelogin.php of Spotweb 1.5.1 and below, which allows remote attackers to inject arbitrary web script or HTML via the dataperformredirect parameter. !/usr/bin/env python3 -- coding: utf-8 -- """There is a Cross Site Scripting XSS...

Admidio - Cross-Site Scripting Detection

A cross-site scripting vulnerability is present in Admidio prior to version 4.0.12. The reflected cross-site scripting vulnerability occurs because redirect.php does not properly validate the value of the url parameter. Through this vulnerability, an attacker is capable to execute malicious...

Longjing Technology BEMS API 1.21 - Unauthenticated Arbitrary File Download Detection

Longjing Technology BEMS API 1.21 is vulnerable to local file inclusion. Input passed through the fileName parameter through the downloads API endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files...

Thinfinity VirtualUI User Enumeration Detection

Thinfinity VirtualUI before v3.0, /changePassword returns different responses for requests depending on whether the username exists. It may enumerate OS users Administrator, Guest, etc. !/usr/bin/env python3 -- coding: utf-8 -- """Thinfinity VirtualUI before v3.""" import re from kittysploit impo...

Oliver 5 Library Server <8.00.008.053 - Local File Inclusion Detection

Oliver 5 Library Server versions prior to 8.00.008.053 are vulnerable to local file inclusion via the FileServlet function. !/usr/bin/env python3 -- coding: utf-8 -- """Oliver 5 Library Server versions prior to 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

HD-Network Realtime Monitoring System 2.0 - Local File Inclusion Detection

Instances of HD-Network Realtime Monitoring System version 2.0 are vulnerable to a Local File Inclusion vulnerability which allows remote unauthenticated attackers to view confidential information. !/usr/bin/env python3 -- coding: utf-8 -- """Instances of HD-Network Realtime Monitoring System...

Keystone 6 Login Page - Open Redirect and Cross-Site Scripting Detection

On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalated to reflected XSS. !/usr/bin/env python3 -- coding: utf-8 -- """On the login page, there is a "from=" parameter in URL which is vulnerable to open redirect and can be escalat.""" from...

WordPress Visual Form Builder <3.0.8 - Information Disclosure Detection

WordPress Visual Form Builder plugin before 3.0.8 contains a information disclosure vulnerability. The plugin does not perform access control on entry form export, allowing an unauthenticated user to export the form entries as CSV files using the vfb-export endpoint. !/usr/bin/env python3 --...

WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting Detection

WorsPress Spider Calendar plugin through 1.5.65 is susceptible to cross-site scripting. The plugin does not sanitize and escape the callback parameter before outputting it back in the page via the window AJAX action, available to both unauthenticated and authenticated users. An attacker can injec...

Microweber Information Disclosure Detection

Microweber contains a vulnerability that allows exposure of sensitive information to an unauthorized actor in Packagist microweber/microweber prior to 1.2.11. !/usr/bin/env python3 -- coding: utf-8 -- """Microweber contains a vulnerability that allows exposure of sensitive information to an...

Atlassian Jira Seraph - Authentication Bypass Detection

Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also...

WordPress Shareaholic <9.7.6 - Information Disclosure Detection

WordPress Shareaholic plugin prior to 9.7.6 is susceptible to information disclosure. The plugin does not have proper authorization check in one of the AJAX actions, available to both unauthenticated before 9.7.5 and authenticated in 9.7.5 users, allowing them to possibly obtain sensitive...

Wordpress Profile Builder Plugin Cross-Site Scripting Detection

The Profile Builder User Profile & User Registration Forms WordPress plugin is vulnerable to cross-site scripting due to insufficient escaping and sanitization of the siteurl parameter found in the /assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a...

Ubigeo de Peru < 3.6.4 - SQL Injection Detection

The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections. !/usr/bin/env python3 -- coding: utf-8 -- """The plugin does not properly sanitise and...

Member Hero <=1.0.9 - Remote Code Execution Detection

WordPress Member Hero plugin through 1.0.9 is susceptible to remote code execution. The plugin lacks authorization checks and does not validate the a request parameter in an AJAX action, allowing an attacker to call arbitrary PHP functions with no arguments. An attacker can thus execute malware,...

WordPress Simple File List <3.2.8 - Local File Inclusion Detection

WordPress Simple File List before 3.2.8 is vulnerable to local file inclusion via the eeFile parameter in the /includes/ee-downloader.php due to missing controls which make it possible for unauthenticated attackers retrieve arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress...

JobMonster < 4.5.2.9 - Cross-Site Scripting Detection

In the theme JobMonster 4.5.2.9 there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. !/usr/bin/env python3 -- coding: utf-8 -- """In the theme JobMonster 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Videos sync PDF <=1.7.4 - Local File Inclusion Detection

WordPress Videos sync PDF 1.7.4 and prior does not validate the p parameter before using it in an include statement, which could lead to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Videos sync PDF 1.""" from kittysploit import from lib.protocols.http.httpclient...

Drawio <18.1.2 - Server-Side Request Forgery Detection

Drawio before 18.1.2 is susceptible to server-side request forgery via the /service endpoint in jgraph/drawio. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 --...

Microweber < 1.2.17 - Cross-Site Scripting Detection

Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site Scripting XSS vulnerability in the /demo/editortools/module endpoint via the 'type' parameter.""" from kittysploit import from...

WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting Detection

WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Contact Form 7 Captcha plugin before...

Crestron Device - Credentials Disclosure Detection

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname...

BigAnt Server v5.6.06 - Local File Inclusion Detection

BigAnt Server v5.6.06 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """BigAnt Server v5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'BigAnt Server v5.6.06 - Local File Inclusion...

Apache NiFi - Information Disclosure Detection

Apache NiFi 1.10.0 through 2.0.0 are missing fine-grained authorization checking for Parameter Contexts, referenced Controller Services, and referenced Parameter Providers, when creating new Process Groups. Creating a new Process Group can include binding to a Parameter Context, but in cases wher...

RTSP - Detect

RTSP was detected. !/usr/bin/env python3 -- coding: utf-8 -- """RTSP was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'RTSP - Detect', 'description': 'RTSP was detected.',...

mDNS / DNS-SD Detection

Queries DNS-SD over unicast or multicast mDNS UDP 5353. In typed mode, probes IoT service types and suggests KittySploit follow-up modules. !/usr/bin/env python3 -- coding: utf-8 -- """Detect mDNS / DNS-SD responders and map IoT service types to modules.""" from kittysploit import from...

SSDP / UPnP Detection

Sends a unicast SSDP M-SEARCH to detect UPnP devices on UDP 1900. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SSDP / UPnP responders.""" from kittysploit import from lib.protocols.ics.icsscannerclient import Icsscannerclient from lib.scanner.ssdp.detectors import probessdp class...

vBulletin Detect

vBulletin is a proprietary forum and community publishing software written in PHP. !/usr/bin/env python3 -- coding: utf-8 -- """vBulletin is a proprietary forum and community publishing software written in PHP.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Google A2A Agent Card - Enumeration Detection

Detected exposed Google Agent-to-Agent protocol agent cards. The agent-card.json file advertises an AI agent's capabilities, supported skills, authentication requirements, and endpoint URLs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed Google Agent-to-Agent protocol agent cards."...

Accueil WAMPSERVER Configuration Page - Detect

Accueil WAMPSERVER configuration page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Accueil WAMPSERVER configuration page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Accueil WAMPSERVER...

Ace Admin Dashboard - Detect

Ace Admin dashboard page was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ace Admin dashboard page was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ace Admin Dashboard - Detect', 'description':...

Let's Encrypt - Cross-Site Scripting Detection

Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL certificates. !/usr/bin/env python3 -- coding: utf-8 -- """Let's Encrypt contains a cross-site scripting vulnerability when using the the ACME protocol to issue SSL cert.""" from kittysploit...

Actifio Resource Center - Panel Detection

Actifio Resource Center was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Actifio Resource Center was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Actifio Resource Center - Panel Detection',...