Veeam Backup & Replication - Unauthenticated Detection

A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution RCE. !/usr/bin/env python3 -- coding: utf-8 -- """A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote.""" from...

Drupal 11.x-dev - Full Path Disclosure Detection

core/authorize.php in Drupal 11.x-dev allows Full Path Disclosure even when error logging is None if the value of hashsalt is filegetcontents of a file that does not exist. !/usr/bin/env python3 -- coding: utf-8 -- """core/authorize.""" from kittysploit import from lib.protocols.http.httpclient...

XWiki Platform - Unauthorized Document History Access Detection

A vulnerability in XWiki Platform's REST API allows unauthorized users to access document history information. The REST API endpoint exposes the history of any page including modification times, version numbers, author details username and display name, and version comments, regardless of access...

Gradio - Open Redirect Detection

An open redirect vulnerability exists in the gradio-app/gradio, affecting the latest version. The vulnerability allows an attacker to redirect users to arbitrary websites, which can be exploited for phishing attacks, Cross-site Scripting XSS, Server-Side Request Forgery SSRF, amongst others. This...

iTop - User Enumeration via REST Endpoint Detection

From the webservices/rest.php file, several operations are accessible from an unauthenticated user. One of them is doresetpwd, allowing to reset a user password. This feature can be abused to perform user enumeration when a non-existent user is provided. !/usr/bin/env python3 -- coding: utf-8 --...

My Geo Posts Free <= 1.2 - PHP Object Injection Detection

The My Geo Posts Free plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 1.2 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If ...

SEH utnserver Pro/ProMAX/INU-100 20.1.22 - File Exposure Detection

A vulnerability was identified in utnserver Pro, utnserver ProMAX, and INU-100 version 20.1.22 and earlier, impacting the file handling functions. This flaw results in authenticated file disclosure, granting unauthorized access to sensitive files and directories. Although authentication is...

IceWarp Server 10.2.1 - Cross-Site Scripting Detection

IceWarp Server 10.2.1 is vulnerable to Cross Site Scripting XSS via the meta parameter. !/usr/bin/env python3 -- coding: utf-8 -- """IceWarp Server 10.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'IceWarp Server...

MasterSAM Star Gate v11 - Local File Inclusion Detection

MasterSAM Star Gate v11 is vulnerable to a directory traversal attack via the endpoint /adama/adama/downloadService. An attacker can exploit this vulnerability by manipulating the file parameter to access arbitrary files on the server, potentially leading to the exposure of sensitive information...

Mitel MiCollab - Arbitary File Read Detection

The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attack...

PrivateGPT < 0.5.0 - Open Redirect Detection

An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. This vulnerability allows attackers to redirect users to a URL specified by user-controlled input without proper validation or sanitization. !/usr/bin/env python3 -- codin...

Campaign Monitor for WordPress - Information Disclosure Detection

Campaign Monitor for WordPress plugin for WordPress versions up to 2.8.15 contains a full path disclosure caused by improper access restriction and enabled displayerrors in /forms/views/admin/create.php, letting unauthenticated attackers retrieve server paths, exploit requires displayerrors to be...

AnythingLLM - Information Disclosure Detection

AnythingLLM suffers from an information disclosure vulnerability through the /api/setup-complete API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM...

Calibre <= 7.15.0 - Reflected Cross-Site Scripting (XSS) Detection

It is possible to inject arbitrary JavaScript code into the /browse endpoint of the Calibre content server, allowing an attacker to craft a URL that when clicked by a victim, will execute the attacker’s JavaScript code in the context of the victim’s browser. If the Calibre server is running with...

SPIP Porte Plume Plugin - Remote Code Execution Detection

The porteplume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user by sending a crafted HTTP request. !/usr/bin/env python3 -- coding: utf-8 -- """Th...

Time Clock <= 1.2.2 & Time Clock Pro <= 1.1.4 - Remote Code Execution Detection

The Time Clock plugin and Time Clock Pro plugin for WordPress are vulnerable to Remote Code Execution in versions up to, and including, 1.2.2 for Time Clock and 1.1.4 for Time Clock Pro via the 'etimeclockwploadfunctioncallback' function. This allows unauthenticated attackers to execute code on t...

Danswer - Insecure Direct Object Reference Detection

The application does not verify whether the attacker is the creator of the file, allowing the attacker to directly call the GET /api/chat/file/fileid interface to view any user's file. !/usr/bin/env python3 -- coding: utf-8 -- """The application does not verify whether the attacker is the creator...

PAN-OS Management Interface - Path Confusion to Authentication Bypass Detection

A vulnerability in PAN-OS management interface allows authentication bypass through path confusion between Nginx and Apache handlers.The issue occurs due to differences in path processing between Nginx and Apache, where double URL encoding combined with directory traversal can bypass authenticati...

MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal Detection

MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 = Maintenance Pack 36 with Servicepack 8 week 36/2025 contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows ...

Integrate Google Drive <= 1.5.3 - Information Disclosure Detection

File Manager for Google Drive - Integrate Google Drive with WordPress plugin for WordPress = 1.5.3 contains sensitive information exposure caused by improper protection of the getlocalizedata function, letting unauthenticated attackers extract Google OAuth credentials and account email addresses,...

Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read Detection

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to and including 1.7.1 via the templateredirect function. The plugin registers 'hippooserve' as a WordPress query variable and uses it to serve PWA files from the pwa/ directory. In...

WP Directory Kit <= 1.4.4 - Authentication Bypass Detection

The WP Directory Kit plugin for WordPress version 1.4.4 and below contains an authentication bypass vulnerability in its auto-login functionality. The vulnerability allows unauthenticated attackers to gain administrative access by exploiting a cryptographically weak token generation mechanism tha...

JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS Detection

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the argument Itemid/jpyearbuilt leads to cross...

WhoDB < 0.45.0 - Path Traversal Detection

WhoDB contains a path traversal caused by lack of validation when opening database files, letting unauthenticated attackers access arbitrary Sqlite3 databases on the host system, exploit requires attacker to manipulate database filename input. !/usr/bin/env python3 -- coding: utf-8 -- """WhoDB...

Label Studio < 1.16.0 - Cross-Site Scripting Detection

Label Studio prior to version 1.16.0 contains a cross-site scripting caused by rendering unsanitized user-provided HTML in the /projects/upload-example endpoint, letting attackers execute arbitrary JavaScript via crafted labelconfig in a GET request, exploit requires victims to visit malicious UR...

TRUfusion Enterprise <= 7.10.4.0 - Admin Contact Portal Detection

TRUfusion Enterprise versions 7.10.4.0 and earlier contained a vulnerability that allowed unauthenticated access to the Internal Admin Contact Page, resulting in the disclosure of PII including partner and contact names. !/usr/bin/env python3 -- coding: utf-8 -- """TRUfusion Enterprise versions...

Kentico Xperience 13 CMS - Staging Service Authentication Bypass

Kentico Staging SyncServer accepts UsernameToken without password WT-2025-0011. !/usr/bin/env python3 -- coding: utf-8 -- """Kentico Xperience 13 CMS - Staging Service Authentication Bypass""" import secrets from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

NocoDB < 0.258.0 - Reflected XSS in Password Reset Detection

NocoDB versions before 0.258.0 contain a reflected cross-site scripting caused by insecure use of '\u003C%-' in resetPassword.ts, letting attackers execute malicious scripts in victims' browsers, exploit requires sending crafted requests to /api/v1/db/auth/password/reset/:tokenId. !/usr/bin/env...

Karel IP Phone IP1211 Web Management Panel - Local File Inclusion Detection

Karel IP Phone IP1211 Web Management Panel is vulnerable to local file inclusion and can allow remote attackers to access arbitrary files stored on the remote device via the 'cgiServer.exx' endpoint and the 'page' parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Karel IP Phone IP1211 Web...

Liferay Portal & DXP - Cross-Site Scripting Detection

Liferay Portal 7.4.0 through 7.4.3.133 and Liferay DXP 2024.Q1.1 through 2025.Q1.4 contain a reflected XSS caused by improper sanitization in entrycoverimagecaption.jsp, letting remote non-authenticated attackers inject JavaScript. !/usr/bin/env python3 -- coding: utf-8 -- """Liferay Portal 7."""...

Letta 0.7.12 - Remote Code Execution

Unauthenticated RCE via POST /v1/tools/run executing attacker tool sourcecode. !/usr/bin/env python3 -- coding: utf-8 -- """Letta 0.7.12 - Remote Code Execution""" import hashlib import json from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

XWiki Platform - Information Disclosure Detection

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 6.1-milestone-2 through 16.10.6, configuration files are accessible through the webjars API. !/usr/bin/env python3 -- coding: utf-8 -- """XWiki Platform is a generic wiki platform...

Service Finder Bookings - Authentication Bypass Detection

Service Finder Bookings WordPress plugin = 6.0 contains a privilege escalation caused by improper validation of user cookie in servicefinderswitchback function, letting unauthenticated attackers login as any user including admins. !/usr/bin/env python3 -- coding: utf-8 -- """Service Finder Bookin...

Zimbra Collaboration - Local File Inclusion Detection

Zimbra Collaboration ZCS 10.0 and 10.1 contain a local file inclusion caused by improper handling of user-supplied parameters in the RestFilter servlet, letting unauthenticated remote attackers include arbitrary files from WebRoot, exploit requires crafted requests to /h/rest endpoint...

WordPress 3D FlipBook <= 1.16.17 - Information Disclosure Detection

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions = 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3dsendpostsin, fb3dsendpostpages, fb3dsendpostsinpages, fb3dsendpostsinfirstpage, and fb3dsendpostfirstpage handlers are...

Video Conferencing with Zoom API < 4.6.6 - Unauthenticated SDK Signature Generation Detection

Zoom WordPress plugin 4.6.6 contains a broken authentication caused by disabled nonce verification in an AJAX handler, letting unauthenticated attackers generate valid Zoom SDK signatures and retrieve the Zoom SDK key. !/usr/bin/env python3 -- coding: utf-8 -- """Zoom WordPress plugin 4.""" from...

Blinko <= 1.8.3 - Path Traversal via /plugins Detection

Blinko = 1.8.3 contains a path traversal caused by improper path concatenation without verification in the plugin file server endpoint, letting remote attackers access arbitrary files, exploit requires network access. !/usr/bin/env python3 -- coding: utf-8 -- """Blinko = 1.""" import re from...

Adminer 4.6.2 - 5.4.1 Unauthenticated Persistent DoS Detection

Adminer = 5.4.1 contains a denial of service caused by lack of origin validation in version check endpoint, letting attackers trigger server errors via crafted POST requests, exploit requires no special privileges. !/usr/bin/env python3 -- coding: utf-8 -- """Adminer = 5.""" from kittysploit impo...

FOSSBilling - Server-Side Template Injection

FOSSBilling stringrender API evaluates unsandboxed Twig, allowing SQL/info disclosure via guest.getDi.db.getCell. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling - Server-Side Template Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

SiYuan Note - Cross-Site Scripting Detection

SiYuan Note through version 3.6.1 is vulnerable to unauthenticated reflected Cross-Site Scripting XSS in the /api/icon/getDynamicIcon endpoint due to improper filtering of SVG elements with a namespace prefix such as . By using a namespaced script element, attackers can bypass the SanitizeSVG...

Open WebUI < 0.9.5 - Information Disclosure Detection

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. !/usr/bin/env python3 -- coding: utf-...

CX Cloud Panel - Detect

CX Cloud panel was detected, !/usr/bin/env python3 -- coding: utf-8 -- """CX Cloud panel was detected,.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'CX Cloud Panel - Detect', 'description': 'CX Cloud panel was...

Cyberoam SSL VPN Panel - Detect

Cyberoam SSL VPN panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberoam SSL VPN panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cyberoam SSL VPN Panel - Detect', 'description':...

Cyberpanel Login Panel - Detect

Cyberpanel login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cyberpanel login panel was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cyberpanel Login Panel - Detect',...

Danswer Panel - Detect

Danswer panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Danswer panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Danswer Panel - Detect', 'description': 'Danswer panel was...

Dash Panel Detect

Detects Dash Panel Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dash Panel Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dash Panel Detect', 'description': 'Detects Dash Panel Detect.',...

Davantis Video Analytics Panel - Detect

Davantis Video Analytics panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Davantis Video Analytics panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Davantis Video Analytics Panel -...

DbGate Anonymous Access - Detection

Detected DbGate instances that allowed anonymous access due to insecure default authentication settings, where unauthenticated users could obtain a valid JWT token and access database management APIs. !/usr/bin/env python3 -- coding: utf-8 -- """Detected DbGate instances that allowed anonymous...

Fedora Default Test Page Detection

Detects Fedora Default Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Fedora Default Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Fedora Default Test Page Detection', 'description':...

Microsoft Azure Default Page Detection

Detects Microsoft Azure Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Microsoft Azure Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft Azure Default Page Detection',...