Django RasterField - SQL Injection Detection

Django 6.0.2, 5.2.11, and 4.2.28 contains a SQL injection caused by improper sanitization of the band index parameter in RasterField on PostGIS, letting remote attackers inject SQL, exploit requires crafted input. !/usr/bin/env python3 -- coding: utf-8 -- """Django 6.""" from kittysploit import...

Nginx HTTP Server Amazon Linux Detection

Detects Nginx HTTP Server Amazon Linux. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx HTTP Server Amazon Linux.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx HTTP Server Amazon Linux Detection',...

Gargoyle Router Management Utility Admin Login Panel - Detect

Gargoyle Router Management Utility admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Gargoyle Router Management Utility admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info ...

MongoDB Ops Manager Login Panel - Detect

MongoDB Ops Manager login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """MongoDB Ops Manager login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'MongoDB Ops Manager Login Panel...

Joomla! Component AlphaUserPoints 1.5.5 - Local File Inclusion Detection

A directory traversal vulnerability in the AlphaUserPoints comalphauserpoints component 1.5.5 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the view parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Spring Boot Status Actuator Panel - Detect

Spring Boot Status Actuator panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Spring Boot Status Actuator panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Spring Boot Status Actuator...

Acrolinx Server <5.2.5 - Local File Inclusion Detection

Acrolinx Server prior to 5.2.5 suffers from a local file inclusion vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Acrolinx Server prior to 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Acrolinx Serv...

elFinder <=2.1.60 - Local File Inclusion Detection

elFinder through 2.1.60 is affected by local file inclusion via connector.minimal.php. This allows unauthenticated remote attackers to read, write, and browse files outside the configured document root. This is due to improper handling of absolute file paths. !/usr/bin/env python3 -- coding: utf-...

WebcamXP 5 Login Panel - Detect

WebcamXP 5 login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """WebcamXP 5 login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WebcamXP 5 Login Panel - Detect', 'description':...

OpenSearch Dashboard Panel - Detect

OpenSearch Dashboard is a visualization and management tool for OpenSearch. This template detects the presence of the OpenSearch Dashboard login panel, which is the default authentication interface for accessing the dashboard. !/usr/bin/env python3 -- coding: utf-8 -- """OpenSearch Dashboard is a...

Operations Automation Default Page Detection

Detects Operations Automation Default Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Operations Automation Default Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Operations Automation Default Page...

Perforce Repository Disclosure Detection

Detected an exposed .p4ignore file, which could have revealed ignored files, sensitive paths, or developer-specific information useful for further enumeration. !/usr/bin/env python3 -- coding: utf-8 -- """Detected an exposed .""" from kittysploit import from lib.protocols.http.httpclient import...

Eko Charger Management Console Login Panel - Detect

Eko Charger Management Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Eko Charger Management Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Eko Charg...

MochiWeb - Detect

Detected servers using the MochiWeb framework through the Server header. !/usr/bin/env python3 -- coding: utf-8 -- """Detected servers using the MochiWeb framework through the Server header.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

KubeView Dashboard - Detect

KubeView dashboard was detected. !/usr/bin/env python3 -- coding: utf-8 -- """KubeView dashboard was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'KubeView Dashboard - Detect', 'description': 'KubeView...

Wanhu OA OfficeServerServlet - Arbitrary File Upload Detection

Wanhu OA officeserverservlet file upload vulnerability !/usr/bin/env python3 -- coding: utf-8 -- """Wanhu OA officeserverservlet file upload vulnerability.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wanhu OA...

ManageEngine Firewall Analyzer <8.0 - Local File Inclusion Detection

ManageEngine Firewall Analyzer before 8.0 is vulnerable to local file inclusion. !/usr/bin/env python3 -- coding: utf-8 -- """ManageEngine Firewall Analyzer before 8.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name':...

Redis Honeypot - Detect

A Redis honeypot has been identified. The response to the 'QUIT' command differs from real installations, signaling a possible deceptive setup. !/usr/bin/env python3 -- coding: utf-8 -- """A Redis honeypot has been identified.""" import socket from kittysploit import from...

Teclib GLPI <= 9.3.3 - Unauthenticated SQL Injection Detection

Teclib GLPI = 9.3.3 exposes a script /scripts/unlocktasks.php that incorrectly sanitizes user controlled data before using it in SQL queries. Thus, an attacker could abuse the affected feature to alter the semantic original SQL query and retrieve database records. !/usr/bin/env python3 -- coding:...

Nginx Status Page Detection

Detects Nginx Status Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Nginx Status Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nginx Status Page Detection', 'description': 'Detects Nginx Status...

WordPress File Manager Plugin - Remote Code Execution Detection

The WordPress File Manager plugin prior to version 6.9 is susceptible to remote code execution. The vulnerability allows unauthenticated remote attackers to upload .php files. !/usr/bin/env python3 -- coding: utf-8 -- """The WordPress File Manager plugin prior to version 6.""" from kittysploit...

Adlisting Classified Ads 2.14.0 - Information Disclosure Detection

Information disclosure issue in the redirect responses, When accessing any page on the website, Sensitive data, such as API keys, server keys, and app IDs, is being exposed in the body of these redirects. !/usr/bin/env python3 -- coding: utf-8 -- """Information disclosure issue in the redirect...

Druid Monitor Login Panel - Detect

Druid Monitor login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Druid Monitor login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Druid Monitor Login Panel - Detect',...

Joomla! Component iF surfALERT 1.2 - Local File Inclusion Detection

A directory traversal vulnerability in the iF surfALERT comifsurfalert component 1.2 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A...

Apache Kafka Client - Arbitrary File Read Detection

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

Nomad - Exposed Jobs Detection

Nomad jobs were discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Nomad jobs were discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nomad - Exposed Jobs Detection', 'description': 'Nomad jobs were...

Zimbra - Cross-Site Scripting via ICS Files Detection

Detects Zimbra Collaboration Suite versions vulnerable to CVE-2025-27915, a stored XSS vulnerability in the Classic Web Client due to insufficient sanitization of HTML content in ICS files. When a user views an email with a malicious ICS entry, embedded JavaScript executes via an ontoggle event...

OLYMPIC Banking System Login Panel - Detect

OLYMPIC Banking System was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OLYMPIC Banking System was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OLYMPIC Banking System Login Panel - Detect',...

Ruckus Wireless Unleashed Login Panel - Detect

Ruckus Wireless Unleashed login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Ruckus Wireless Unleashed login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Ruckus Wireless...

bower.json File Disclosure Detection

Bower is a package manager which stores package information in the bower.json file !/usr/bin/env python3 -- coding: utf-8 -- """Bower is a package manager which stores package information in the bower.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Netscaler Gateway Detection

Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applications to an end user. !/usr/bin/env python3 -- coding: utf-8 -- """Citrix NetScaler is an application delivery controller that improves the delivery speed and quality of applica.""" from...

Thruk Login Panel - Detect

Thruk Monitoring panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Thruk Monitoring panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Thruk Login Panel - Detect', 'description': 'Thru...

Z-BlogPHP Admin Login Panel - Detect

Z-BlogPHP admin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Z-BlogPHP admin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Z-BlogPHP Admin Login Panel - Detect',...

WordPress XMLRPC Detection

Detects WordPress XMLRPC. !/usr/bin/env python3 -- coding: utf-8 -- """Detects WordPress XMLRPC.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'WordPress XMLRPC Detection', 'description': 'Detects WordPress XMLRPC.'...

Wagtail Login - Detect

The Wagtail panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """The Wagtail panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Wagtail Login - Detect', 'description': 'The...

Blackboard - Cross-Site Scripting Detection

Blackboard contains a cross-site scripting vulnerability. An attacker can execute arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. !/usr/bin/env pytho...

viewLinc 5.1.2.367 - Carriage Return Line Feed Attack Detection

viewLinc 5.1.2.367 and sometimes 5.1.1.50 allows remote attackers to inject a carriage return line feed CRLF character into the responses returned by the product, which allows attackers to inject arbitrary HTTP headers into the response returned. !/usr/bin/env python3 -- coding: utf-8 --...

TYPO3 Installer Detection

TYPO3 is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """TYPO3 is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Grow by Tradedoubler Plugin < 2.0.22 - Unauthenticated Local File Inclusion Detection

The Grow by Tradedoubler WordPress plugin through version 2.0.21 is vulnerable to Local File Inclusion via the component parameter. This makes it possible for attackers to include and execute PHP files on the server, allowing the execution of any PHP code in those files. !/usr/bin/env python3 --...

Reolink Panel - Detect

Reolink panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Reolink panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Reolink Panel - Detect', 'description': 'Reolink panel was...

ServiceNow UI Macros - Template Injection Detection

ServiceNow has addressed an input validation vulnerability that was identified in Vancouver and Washington DC Now Platform releases. This vulnerability could enable an unauthenticated user to remotely execute code within the context of the Now Platform. ServiceNow applied an update to hosted...

KafDrop - Cross-Site Scripting Detection

KafDrop contains a cross-site scripting vulnerability. It allows remote unauthenticated attackers to inject arbitrary HTML and/or JavaScript into the response returned by the server. !/usr/bin/env python3 -- coding: utf-8 -- """KafDrop contains a cross-site scripting vulnerability.""" from...

Ackee Panel Detection

Detects Ackee self-hosted analytics login panels. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Ackee analytics panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = "name": "Ackee Panel Detection", "description":...

Microsoft Exchange Admin Center Login Panel - Detect

Microsoft Exchange Admin Center login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Admin Center login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microso...

WAVLINK WN530HG4 - Improper Access Control Detection

WAVLINK WN530HG4 M30HG4.V5030.191116 is susceptible to improper access control. An attacker can obtain usernames and passwords via view-source:http://IPADDRESS/setsafety.shtml?r=52300 and searching for var syspasswd and thereby possibly obtain sensitive information, modify data, and/or execute...

SAPControl ListConfigFiles - Disclosure Detection

Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the ListConfigFiles web method without authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected SAP systems where the SAP Start Service sapstartsrv SAPControl SOAP interface exposes the...

Dash Panel Detect

Detects Dash Panel Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Dash Panel Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dash Panel Detect', 'description': 'Detects Dash Panel Detect.',...

Microweber Exposed Installation - Detected

Microweber Installation page was exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Microweber Installation page was exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microweber Exposed Installation -...

OpenNMS Web Console Login Panel - Detect

OpenNMS Web Console login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """OpenNMS Web Console login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'OpenNMS Web Console Login Panel...

Vespa - Detect

Vespa, an open-source big-data serving engine used for low-latency search, recommendation, and vector/embedding retrieval, increasingly deployed as the retrieval backend in AI and RAG retrieval-augmented generation pipelines, was detected. Exposed config-server or container endpoints could have...