FOSSBilling Panel - Detect

FOSSBilling panel has been detected. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling panel has been detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'FOSSBilling Panel - Detect', 'description':...

PrismaWEB - Credentials Disclosure Detection

PrismaWEB is susceptible to credential disclosure. The vulnerability exists due to the disclosure of hard-coded credentials allowing an attacker to effectively bypass authentication of PrismaWEB with administrator privileges. The credentials can be disclosed by simply navigating to the loginpar.j...

Jupyter Notebook - Remote Command Execution Detection

Jupyter Notebook is an interactive Notebook, computer application is a web based visualization, Jupyter Notebook API/terminals path there are loopholes in the remote command execution. !/usr/bin/env python3 -- coding: utf-8 -- """Jupyter Notebook is an interactive Notebook, computer application i...

Content Central Login Panel - Detect

Content Central login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Content Central login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Content Central Login Panel - Detect',...

Joomla jMarket 5.15 - Cross-Site Scripting Detection

The attacker can send to victim a link containing a malicious URL in an email or instant message can perform a wide variety of actions, such as stealing the victim's session token or login credentials. !/usr/bin/env python3 -- coding: utf-8 -- """The attacker can send to victim a link containing ...

Espocrm Installer Detection

Espocrm is susceptible to the Installation page exposure due to misconfiguration. !/usr/bin/env python3 -- coding: utf-8 -- """Espocrm is susceptible to the Installation page exposure due to misconfiguration.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

WordPress Pie Register <= 3.7.1.4 - Authentication Bypass Detection

An authentication bypass vulnerability exists in the WordPress Pie Register plugin ≤ 3.7.1.4 that allows unauthenticated attackers to impersonate arbitrary users by submitting a crafted POST request to the login endpoint. By setting socialsite=true and manipulating the useridsocialsite parameter,...

myLittleAdmin Login Panel - Detect

myLittleAdmin login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """myLittleAdmin login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'myLittleAdmin Login Panel - Detect',...

Cisco Unified Communications Manager - User Enumeration Detection

Cisco Unified Call Manager is vulnerable to username enumeration. This template enumerates valid usernames and emails from the Cisco UCM UDS API. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Unified Call Manager is vulnerable to username enumeration.""" from kittysploit import from...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure Detection

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. !/usr/bin/env...

LVM Exporter Metrics Detection

LVM Exporter Metrics is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """LVM Exporter Metrics is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LVM Exporter Metrics Detection', 'description': 'LVM...

Neobox Web Server Login Panel - Detect

Neobox Web Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Neobox Web Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Neobox Web Server Login Panel -...

Cisco IOS XE - Detect

Cisco IOS XE login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco IOS XE login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Cisco IOS XE - Detect', 'description': 'Cisco...

Kyocera Printer Panel - Detect

Kyocera printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kyocera printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kyocera Printer Panel - Detect', 'description':...

WordPress Storefront Theme - Full Path Disclosure Detection

The Storefront theme for WordPress was detected to be vulnerable to Full Path Disclosure, allowing unauthenticated attackers to obtain the full application path that could aid other attacks when combined with another vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Storefront theme...

Joomla! Component JProject Manager 1.0 - Local File Inclusion Detection

A directory traversal vulnerability in the Ternaria Informatica JProject Manager comjprojectmanager component 1.0 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impact via a .. dot dot in the controller parameter to index.php. !/usr/bin/env python3...

Exposed Core Dump - File Disclosure Detection

Exposed Core Dump internal file is disclosed. !/usr/bin/env python3 -- coding: utf-8 -- """Exposed Core Dump internal file is disclosed.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Exposed Core Dump -...

ModX CMS - Unfinished Installation Detection

Detected accessible ModX CMS installation or setup pages that indicated an incomplete installation.An exposed installation interface allowed attackers to complete the setup process and gain administrative access. !/usr/bin/env python3 -- coding: utf-8 -- """Detected accessible ModX CMS installati...

FileZilla FTP Service - Detect

FileZilla FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """FileZilla FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'FileZilla FTP Servic...

JFrog Artifactory 6.7.3 - Admin Login Bypass Detection

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

Cisco ISE Admin Login Panel - Detect

Cisco Identity Services Engine ISE admin login panel was discovered. !/usr/bin/env python3 -- coding: utf-8 -- """Cisco Identity Services Engine ISE admin login panel was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

Microsoft Exchange Server - Cross-Site Scripting Detection

Microsoft Exchange Server, or OWA, is vulnerable to a cross-site scripting vulnerability in refurl parameter of frowny.asp. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Server, or OWA, is vulnerable to a cross-site scripting vulnerability in refurl parameter o.""" from...

FOSSBilling - Server-Side Template Injection

FOSSBilling stringrender API evaluates unsandboxed Twig, allowing SQL/info disclosure via guest.getDi.db.getCell. !/usr/bin/env python3 -- coding: utf-8 -- """FOSSBilling - Server-Side Template Injection""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient cla...

NuGet Package.config File Disclosure Detection

Detects NuGet Package.config File Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects NuGet Package.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'NuGet Package.config File Disclosure Detection',...

Apache2 Default Test Page Detection

Detects Apache2 Default Test Page. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Apache2 Default Test Page.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Apache2 Default Test Page Detection', 'description':...

Dell DPI Remote Power Management - Detect

The Dell Metered Rack Power Distribution Unit distributes power to a server rack and are installed at the rear of a rack enclosure. !/usr/bin/env python3 -- coding: utf-8 -- """The Dell Metered Rack Power Distribution Unit distributes power to a server rack and are installed at the rear.""" from...

Moodle Jmol Filter 6.1 - Local File Inclusion Detection

Moodle Jmol Filter 6.1 is vulnerable to local file inclusion through the jsmol.php file, allowing attackers to read arbitrary files on the server. !/usr/bin/env python3 -- coding: utf-8 -- """Moodle Jmol Filter 6.""" import re from kittysploit import from lib.protocols.http.httpclient import...

Joomla! Component SMEStorage - Local File Inclusion Detection

A directory traversal vulnerability in the SMEStorage comsmestorage component before 1.1 for Joomla! allows remote attackers to read arbitrary files via directory traversal sequences in the controller parameter to index.php. !/usr/bin/env python3 -- coding: utf-8 -- """A directory traversal...

Beszel Unfinished Installation Detection

Detected Beszel server monitoring hub had an unfinished installation with no admin account configured, allowing attackers to create an admin account and gain full control. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Beszel server monitoring hub had an unfinished installation with no adm...

LabKey Server Login Panel - Detect

LabKey Server login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """LabKey Server login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'LabKey Server Login Panel - Detect',...

IBM WebSphere Application - Source File Exposure Detection

Disclose application specific files contained within the war file, including files under the web-inf and meta-inf directories. !/usr/bin/env python3 -- coding: utf-8 -- """Disclose application specific files contained within the war file, including files under the web-inf and meta-.""" from...

Query hashed password via QueryBuilder Servlet Detection

AEM hased password can be queried via QueryBuilder Servlet. !/usr/bin/env python3 -- coding: utf-8 -- """AEM hased password can be queried via QueryBuilder Servlet.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Que...

Podcast Channels < 0.28 - Cross-Site Scripting Detection

The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting security vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The Podcast Channels WordPress plugin was affected by an unauthenticated reflected cross-site scripting securi.""" from...

AEM QueryBuilder Feed Servlet Detection

Detects AEM QueryBuilder Feed Servlet. !/usr/bin/env python3 -- coding: utf-8 -- """Detects AEM QueryBuilder Feed Servlet.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'AEM QueryBuilder Feed Servlet Detection',...

TOTOLINK CP450 v4.1.0cu.747_B20191224 - Hard-Coded Password Vulnerability Detection

A critical vulnerability has been discovered in TOTOLINK CP450 version 4.1.0cu.747B20191224. This vulnerability affects an unknown part of the file /webcste/cgi-bin/product.ini of the Telnet Service component. The issue stems from the use of a hard-coded password, which can be exploited remotely...

Dataiku - Default Login Detection

Dataiku contains a default login vulnerability. An attacker can obtain access to user accounts and access sensitive information, modify data, and/or execute unauthorized operations. This vulnerability may also lead to server-side request forgery and/or remote code execution. !/usr/bin/env python3...

GLPI Panel - Detect

GLPI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GLPI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GLPI Panel - Detect', 'description': 'GLPI panel was detected.', 'author'...

Jolokia Java Heap Information Disclosure Detection

Detects Jolokia Java Heap Information Disclosure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Jolokia Java Heap Information Disclosure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jolokia Java Heap...

Cisco Finesse - Detect

Detected Cisco Finesse application and extracted version information from multiple sources. !/usr/bin/env python3 -- coding: utf-8 -- """Detected Cisco Finesse application and extracted version information from multiple sources.""" from kittysploit import from lib.protocols.http.httpclient import...

Zabbix - SAML SSO Authentication Bypass Detection

When SAML SSO authentication is enabled non-default, session data can be modified by a malicious actor because a user login stored in the session was not verified. !/usr/bin/env python3 -- coding: utf-8 -- """When SAML SSO authentication is enabled non-default, session data can be modified by a...

YesWiki - Cross-Site Scripting Detection

YesWiki versions 4.5.3 are vulnerable to multiple reflected cross-site scripting XSS vulnerabilities, allowing arbitrary JavaScript execution. !/usr/bin/env python3 -- coding: utf-8 -- """YesWiki versions 4.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Jackett - Installer Detection

Jackett installer exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Jackett installer exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Jackett - Installer Detection', 'description': 'Jackett installer...

Quest KACE System Management Appliance 8.0.318 - Remote Code Execution Detection

Detects exposed Quest KACE SMA /common/downloadagentinstaller.php CVE-2018-11138. Requires product-specific response content, not generic page text. !/usr/bin/env python3 -- coding: utf-8 -- """Quest KACE SMA CVE-2018-11138 — downloadagentinstaller.php exposure.""" from kittysploit import from...

TRENDnet TEW-827DRU Login Panel - Detect

TRENDnet TEW-827DRU login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """TRENDnet TEW-827DRU login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'TRENDnet TEW-827DRU Login Panel...

Deluge WebUI Login Panel - Detect

Deluge WebUI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Deluge WebUI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Deluge WebUI Login Panel - Detect',...

PHPJabbers Taxi Booking 2.0 - Cross Site Scripting Detection

A vulnerability classified as problematic was found in PHP Jabbers Taxi Booking 2.0. Affected by this vulnerability is an unknown functionality of the file /index.php. The manipulation of the argument index leads to cross site scripting. The attack can be launched remotely. !/usr/bin/env python3 ...

Kubelet Metrics Detection

Kube Metrics Server was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Kube Metrics Server was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Kubelet Metrics Detection', 'description': 'Kube Metric...

Divi Form Builder - Detect

Divi Form Builder is a premium WordPress form plugin by Divi Engine. !/usr/bin/env python3 -- coding: utf-8 -- """Divi Form Builder is a premium WordPress form plugin by Divi Engine.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient:...

SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting Detection

SAP Knowledge Warehouse 7.30, 7.31, 7.40, and 7.50 contain a reflected cross-site scripting vulnerability via the usage of one SAP KW component within a web browser. !/usr/bin/env python3 -- coding: utf-8 -- """SAP Knowledge Warehouse 7.""" from kittysploit import from lib.protocols.http.httpclie...

Dynamicweb Login Panel - Detect

Dynamicweb login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Dynamicweb login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Dynamicweb Login Panel - Detect', 'description':...