EMQX Login Panel - Detect

EMQX login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """EMQX login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'EMQX Login Panel - Detect', 'description': 'EMQX login panel...

Detect Graylog REST API

Detects Detect Graylog REST API. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Detect Graylog REST API.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Detect Graylog REST API', 'description': 'Detects Detect...

Huawei Router - Authentication Bypass Detection

Huawei Routers are vulnerable to authentication bypass because the default password of this router is the last 8 characters of the device's serial number which exist on the back of the device. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei Routers are vulnerable to authentication bypass...

DocuWare - Detect

DocuWare panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """DocuWare panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DocuWare - Detect', 'description': 'DocuWare panel was detected.'...

QuestDB Console - Detect

QuestDB console was detected. !/usr/bin/env python3 -- coding: utf-8 -- """QuestDB console was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'QuestDB Console - Detect', 'description': 'QuestDB console was...

Seagate NAS Login - Detect

Seagate NAS - SEAGATE Login was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Seagate NAS - SEAGATE Login was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Seagate NAS Login - Detect',...

WordPress Gallery <2.0.0 - Cross-Site Scripting Detection

WordPress Gallery plugin before 2.0.0 contains a reflected cross-site scripting vulnerability. It does not sanitize and escape a parameter before outputting it back in the response of an AJAX action, available to both unauthenticated and authenticated users. !/usr/bin/env python3 -- coding: utf-8...

Microsoft SharePoint - Master Page Disclosure Detection

Detected exposed SharePoint Master Page endpoints. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed SharePoint Master Page endpoints.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft SharePoint ...

ICT Protege WX Login Panel - Detect

Detects ICT Protege WX Login Panel - Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects ICT Protege WX Login Panel - Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'ICT Protege WX Login Panel -...

Supertokens Login Panel - Detect

A Supertokens login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """A Supertokens login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Supertokens Login Panel - Detect',...

Dotclear Admin Login Panel - Detect

Dotclear admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dotclear admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dotclear Admin Login Panel - Detect',...

HOOBS Panel - Detect

HOOBS is a home automation platform that bridges HomeKit and non-HomeKit devices. !/usr/bin/env python3 -- coding: utf-8 -- """HOOBS is a home automation platform that bridges HomeKit and non-HomeKit devices.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Plugin SG Optimizer - Full Path Disclosure Detection

WordPress Plugin SG Optimizer Plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin SG Optimizer Plugin files are publicly...

YzmCMS Login Panel - Detect

YzmCMS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """YzmCMS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'YzmCMS Login Panel - Detect', 'description': 'YzmCMS logi...

Fortinet FortiAnalyzer - Login Panel Detection

Fortinet FortiAnalyzer is a centralised log management and analytics platform for Fortinet security devices. The web management console is commonly internet-exposed on ports 443, 10443, 9443, or 4443. !/usr/bin/env python3 -- coding: utf-8 -- """Fortinet FortiAnalyzer is a centralised log...

Forcepoint Appliance Detection

Detects Forcepoint Appliance. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Forcepoint Appliance.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Forcepoint Appliance Detection', 'description': 'Detects...

Pterodactyl game server - Panel Detection

Detects Pterodactyl game server management panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Pterodactyl game server management panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pterodactyl game server...

Avaya Aura System Manager Login - Panel Detect

Avaya Aura System Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Avaya Aura System Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Avaya Aura System...

SEO King - Shopify App — Installer Detection

Shopify App is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Shopify App is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Laravel log file publicly accessible Detection

The log file of this Laravel web app might reveal details on the inner workings of the app, possibly even tokens, credentials or personal information. !/usr/bin/env python3 -- coding: utf-8 -- """The log file of this Laravel web app might reveal details on the inner workings of the app, possibly...

DBeaver Database Connections - Detect

DBeaver database connections were detected. !/usr/bin/env python3 -- coding: utf-8 -- """DBeaver database connections were detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'DBeaver Database Connections -...

LibreChat Login Panel - Detection

Detected LibreChat login panel. LibreChat is an open-source, self-hosted AI chat interface. !/usr/bin/env python3 -- coding: utf-8 -- """Detected LibreChat login panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

SonicWall Network Security Login - Detect

SonicWall Network Security Login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """SonicWall Network Security Login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'SonicWall Network...

LM Studio Panel - Detect

LM Studio is a desktop application for discovering, downloading, and running local LLMs !/usr/bin/env python3 -- coding: utf-8 -- """LM Studio is a desktop application for discovering, downloading, and running local LLMs.""" from kittysploit import from lib.protocols.http.httpclient import...

OpenHAP Detection

Detects OpenHAP Detection. !/usr/bin/env python3 -- coding: utf-8 -- """Detects OpenHAP Detection.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenHAP Detection', 'description': 'Detects OpenHAP Detection.',...

Aethra Telecommunications Login - Panel Detection

Aethra Telecommunication login Panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Aethra Telecommunication login Panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Aethra...

Statamic - Detect

Statamic is the flat-first, Laravel + Git powered CMS designed for building beautiful, easy to manage websites. !/usr/bin/env python3 -- coding: utf-8 -- """Statamic is the flat-first, Laravel + Git powered CMS designed for building beautiful, easy to manage websites.""" import re from kittysploi...

Amcrest Login Detection

An Amcrest LDAP user login was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """An Amcrest LDAP user login was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Amcrest Login Detection',...

PocketBase Panel - Detect

PocketBase Login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """PocketBase Login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PocketBase Panel - Detect', 'description':...

Icecast Config - File Disclosure Detection

Icecast Config file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Icecast Config file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Icecast Config - File Disclosure Detection', 'description':...

Pair Drop Panel - Detect

Local file sharing in your browser. Inspired by Apple's AirDrop. Fork of Snapdrop. !/usr/bin/env python3 -- coding: utf-8 -- """Local file sharing in your browser.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Pair...

Nortek Linear eMerge Panel - Detect

Nortek Linear eMerge panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nortek Linear eMerge panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nortek Linear eMerge Panel -...

phpShowtime 2.0 - Directory Traversal Detection

A directory traversal vulnerability in phpShowtime 2.0 allows remote attackers to list arbitrary directories and image files via a .. dot dot in the r parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal vulnerability in phpShowtime 2.""" import re from...

CaseAware a360inc - Cross-Site Scripting Detection

a360inc CaseAware contains a reflected cross-site scripting vulnerability via the user parameter transmitted in the login.php query string. This is a bypass of the fix reported in 2017 !/usr/bin/env python3 -- coding: utf-8 -- """a360inc CaseAware contains a reflected cross-site scripting...

EVlink City < R8 V3.4.0.1 - Authentication Bypass Detection

A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1, EVlink Parking EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1, and EVlink Smart Wallbox EVB1A all versions prior to R8 V3.4.0.1 that could allow an attacker t...

WordPress Duplicate Page - Full Path Disclosure Detection

WordPress Plugin Duplicate Page files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin Duplicate Page files are publicly accessible withou...

3CX Config - File Disclosure Detection

3CX Configuration file was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """3CX Configuration file was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': '3CX Config - File Disclosure Detection',...

WordPress Plugin InfiniteWP Client - Full Path Disclosure Detection

WordPress InfiniteWP Client plugin is vulnerable to full path disclosure via direct access to plugin files. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress InfiniteWP Client plugin is vulnerable to full path disclosure via direct access to plugin files.""" from kittysploit import from...

WordPress WPFront Scroll Top - Full Path Disclosure Detection

WordPress Plugin WPFront Scroll Top plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin WPFront Scroll Top plugin files are...

Aurelia-Path < 1.1.7 - Prototype Pollution Detection

Aurelia-path before 1.1.7 contains a prototype pollution caused by parsing malicious URL parameters, letting attackers modify Object.prototype, exploit requires the application to parse user-controlled URLs. !/usr/bin/env python3 -- coding: utf-8 -- """Aurelia-path before 1.""" from kittysploit...

Flarum < 1.8.5 - Open Redirect Detection

Flarum is open source discussion platform software. Prior to version 1.8.5, the Flarum /logout route includes a redirect parameter that allows any third party to redirect users from a trusted domain of the Flarum installation to redirect to any link. For logged-in users, the logout must be...

Unauth Hawkeye Dashboard - Detect

Hawkeye Dashboard was detected and appeared to be accessible without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Hawkeye Dashboard was detected and appeared to be accessible without authentication.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient...

Huawei HG532e Default Credential Detection

Huawei HG532e default admin credentials were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Huawei HG532e default admin credentials were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Huawei...

WordPress Astra - Full Path Disclosure Detection

WordPress Astra Theme files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Astra Theme files are publicly accessible without ABSPATH protection...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability Detection

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

Graphql wpgraphql Detect

Detects Graphql wpgraphql Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql wpgraphql Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql wpgraphql Detect', 'description': 'Detects...

PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting Detection

A vulnerability was found in PHP Jabbers Bus Reservation System 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument index/pickupid leads to cross site scripting. The attack may be launched remotely...

WeiPHP 5.0 - SQL Injection Detection

WeiPHP 5.0 contains a SQL injection vulnerability via the wpwhere function. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. !/usr/bin/env python3 -- coding: utf-8 -- """WeiP...

Temenos Transact - Cross-Site Scripting Detection

Multiple vulnerabilities in Temenos Transact formerly T24 that allows multiple reflected cross-site scripting XSS attacks. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple vulnerabilities in Temenos Transact formerly T24 that allows multiple reflected cross-site scriptin.""" from kittysploit...

WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting Detection

Multiple cross-site scripting vulnerabilities in views/notify.php in the Uploader plugin 1.0.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 notify or 2 blog parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Multiple cross-site scripting vulnerabiliti...