Kedacom Network Keyboard Console - Arbitrary File Read Detection

There is an arbitrary file reading vulnerability in the KEDACOM network keyboard console. Attacking this vulnerability can read arbitrary information from the server !/usr/bin/env python3 -- coding: utf-8 -- """There is an arbitrary file reading vulnerability in the KEDACOM network keyboard...

Ruijie RG-NBS2009G-P - Improper Authentication Detection

An issue in Ruijie RG-NBS2009G-P RGOS v.10.41P2 Release9736 allows a remote attacker to gain privileges via the system/configmenu.htm. !/usr/bin/env python3 -- coding: utf-8 -- """An issue in Ruijie RG-NBS2009G-P RGOS v.""" from kittysploit import from lib.protocols.http.httpclient import...

iXBus Login Panel - Detect

iXBus login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """iXBus login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'iXBus Login Panel - Detect', 'description': 'iXBus login...

Jenkins build-metrics 1.3 - Cross-Site Scripting Detection

Jenkins build-metrics 1.3 is vulnerable to a reflected cross-site scripting vulnerability that allows attackers to inject arbitrary HTML and JavaScript into the web pages the plugin provides. !/usr/bin/env python3 -- coding: utf-8 -- """Jenkins build-metrics 1.""" from kittysploit import from...

Homer Panel - Detect

A simple static homepage was discovered !/usr/bin/env python3 -- coding: utf-8 -- """A simple static homepage was discovered.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Homer Panel - Detect', 'description': 'A...

Laragon - phpinfo Disclosure Detection

Laragon phpinfo file was exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Laragon phpinfo file was exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Laragon - phpinfo Disclosure Detection', 'description':...

Telnet Detection

Telnet is a network protocol used to virtually access a computer and to provide a two-way, collaborative and text-based communication channel between two machines. !/usr/bin/env python3 -- coding: utf-8 -- """Telnet is a network protocol used to virtually access a computer and to provide a two-wa...

WordPress Events Manager - Full Path Disclosure Detection

WordPress WP Super Cache plugin files are publicly accessible without ABSPATH protection, exposing sensitive server path information through PHP error messages when accessed directly. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress WP Super Cache plugin files are publicly accessible withou...

Discover db schema files Detection

This file is auto-generated from the current state of the database. !/usr/bin/env python3 -- coding: utf-8 -- """This file is auto-generated from the current state of the database.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: inf...

GoAnywhere Web Client Login Panel - Detect

GoAnywhere Web Client login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """GoAnywhere Web Client login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'GoAnywhere Web Client Login...

qdPM Login Panel Detection

Detects qdPM Login Panel. !/usr/bin/env python3 -- coding: utf-8 -- """Detects qdPM Login Panel.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'qdPM Login Panel Detection', 'description': 'Detects qdPM Login Panel.'...

Graphql Hasura Detect

Detects Graphql Hasura Detect. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Graphql Hasura Detect.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Graphql Hasura Detect', 'description': 'Detects Graphql Hasur...

WooCommerce Blocks 2.5 to 5.5 - Unauthenticated SQL Injection Detection

woocommerce-gutenberg-products-block is a feature plugin for WooCommerce Gutenberg Blocks. An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. Via a carefully crafted URL, an exploit can be...

UiPath Orchestrator Login Panel - Detect

UiPath Orchestrator login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """UiPath Orchestrator login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'UiPath Orchestrator Login Panel...

MooSocial 3.1.8 - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. !/usr/bin/env python3 -- coding: utf-8 -- """A reflected cross-site scripting XSS vulnerability...

Liferay Portal - Cross-Site Scripting Detection

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12, 7.4 GA through update 92 allows an remote non-authenticated...

Maestro LuCI Login Panel - Detect

Maestro LuCI login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Maestro LuCI login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Maestro LuCI Login Panel - Detect',...

Microsoft Exchange Web Service - Detect

Microsoft Exchange Web Services was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Microsoft Exchange Web Services was detected.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Microsoft Exchange We...

Microsoft IIS version detect

Some Microsoft IIS servers have the version on the response header. Useful when you need to find specific CVEs on your targets. !/usr/bin/env python3 -- coding: utf-8 -- """Some Microsoft IIS servers have the version on the response header.""" from kittysploit import from...

WP Helper Lite < 4.3 - Cross-Site Scripting Detection

The WP Helper Lite WordPress plugin, in versions 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """The WP Helper Lite WordPress plugin, in versions 4.""" from kittysploit import fr...

Expect-CT Header - Misconfigured Detection

Detected misconfigured Expect-CT headers: max-age is 0 ineffective and enforce directive is missing !/usr/bin/env python3 -- coding: utf-8 -- """Detected misconfigured Expect-CT headers: max-age is 0 ineffective and enforce directive is missing.""" from kittysploit import from...

DotNetNuke 5.0.0 - 9.3.0 - Cookie Deserialization Remote Code Execution Detection

DotNetNuke DNN versions between 5.0.0 - 9.3.0 are affected by a deserialization vulnerability that leads to remote code execution. !/usr/bin/env python3 -- coding: utf-8 -- """DotNetNuke DNN versions between 5.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

HyperComments <= 1.2.2 - Arbitrary Options Update Detection

The HyperComments plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the hcrequesthandler function in all versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to...

Micro Focus Filr Login Panel - Detect

Micro Focus Filr login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Micro Focus Filr login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Micro Focus Filr Login Panel - Detect...

CS-Cart - Local File Inclusion Detection

CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers to access locally stored files and reveal their content. !/usr/bin/env python3 -- coding: utf-8 -- """CS-Cart is vulnerable to local file inclusion because it allows remote unauthenticated attackers t...

Weaver E-Cology JqueryFileTree - Directory Traversal Detection

Panwei OA E-Cology jqueryFileTree.jsp directory traversal vulnerability. !/usr/bin/env python3 -- coding: utf-8 -- """Panwei OA E-Cology jqueryFileTree.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Weaver E-Cology...

Vanna AI Panel - Detect

Vanna AI is a chat interface for text-to-SQL generation using natural language. This template detects the presence of a Vanna AI chat panel. !/usr/bin/env python3 -- coding: utf-8 -- """Vanna AI is a chat interface for text-to-SQL generation using natural language.""" import re from kittysploit...

D-Link DIR-615 - Unauthorized Access Detection

D-Link DIR-615 devices with firmware 20.06 are susceptible to unauthorized access. An attacker can access the WAN configuration page wan.htm without authentication, which can lead to disclosure of WAN settings, data modification, and/or other unauthorized operations. !/usr/bin/env python3 --...

Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution Detection

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...

Zebra Printer Detect

Zebra Printer panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Zebra Printer panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Zebra Printer Detect', 'description': 'Zebra Printer...

Automatisch Panel - Detect

The open source Zapier alternative. !/usr/bin/env python3 -- coding: utf-8 -- """The open source Zapier alternative.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Automatisch Panel - Detect', 'description': 'The op...

Oracle Fusion - Directory Traversal/Local File Inclusion Detection

Oracle Business Intelligence Enterprise Edition 5.5.0.0.0, 12.2.1.3.0, and 12.2.1.4.0 are vulnerable to local file inclusion vulnerabilities via "getPreviewImage." !/usr/bin/env python3 -- coding: utf-8 -- """Oracle Business Intelligence Enterprise Edition 5.""" import re from kittysploit import...

PRONOTE Login Panel - Detect

PRONOTE products was detected. !/usr/bin/env python3 -- coding: utf-8 -- """PRONOTE products was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'PRONOTE Login Panel - Detect', 'description': 'PRONOTE produc...

WordPress Plugin CodeArt Google MP3 Player - File Disclosure Download Detection

WordPress Plugin CodeArt Google MP3 Player allows an unauthenticated attacker to download file from server. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Plugin CodeArt Google MP3 Player allows an unauthenticated attacker to download file from server.""" from kittysploit import from...

DoorGets CMS v7.0 - Information Disclosure Detection

doorGets 7.0 has a sensitive information disclosure vulnerability in /setup/temp/admin.php. A remote unauthenticated attacker could exploit this vulnerability to obtain administrator's password. !/usr/bin/env python3 -- coding: utf-8 -- """doorGets 7.""" from kittysploit import from...

EPP Server - Local File Inclusion Detection

servlet called "CitiesServlet" that handles HTTP GET requests, so the user-provided input, obtained from the country parameter, is directly concatenated with the "/cities/cities" string to form the fileName, This means an attacker can manipulate the country parameter and potentially access...

Badarg Log File Exposure Detection

Badarg log file was exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Badarg log file was exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Badarg Log File Exposure Detection', 'description': 'Badarg log...

Weblate Public Project - Exposure Detection

Weblate instance is publicly accessible. Public exposure of Weblate may lead to unauthorized access to translation projects, potential data leaks, credential exposure, or manipulation of open source localization data. Attackers can view available projects and access sensitive information if prope...

POS Codekop v2.0 - Cross Site Scripting Detection

POS Codekop v2.0 was discovered to contain a reflected cross-site scripting XSS vulnerability via the nmmember parameter at print.php. !/usr/bin/env python3 -- coding: utf-8 -- """POS Codekop v2.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner,...

Zhiyuan OA Arbitrary File Upload Vulnerability Detection

A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload arbitrary files to the remote server and cause execute arbitrary code to be executed. !/usr/bin/env python3 -- coding: utf-8 -- """A vulnerability in Zhiyuan OA allows remote unauthenticated attackers to upload...

LearnPress < 4.3.0 - Arbitrary Callback Execution to Information Exposure Detection

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Sensitive Information Disclosure in all versions up to, and including, 4.2.9.4. This is due to missing capability checks in the REST endpoint /wp-json/lp/v1/loadcontentviaajax which allows arbitrary callback execution of...

Extreme NetConfig UI Panel - Detect

Extreme NetConfig UI panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Extreme NetConfig UI panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Extreme NetConfig UI Panel - Detect',...

Iomega LenovoEMC NAS Login Panel - Detect

Iomega LenovoEMC NAS login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Iomega LenovoEMC NAS login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Iomega LenovoEMC NAS Login...

Strapi CMS Documentation Login Panel - Detect

Strapi CMS Documentation login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Strapi CMS Documentation login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Strapi CMS...

RaspberryMatic Login Panel - Detect

RaspberryMatic login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """RaspberryMatic login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'RaspberryMatic Login Panel - Detect',...

Caucho Resin - Information Disclosure Detection

Caucho Resin contains an information disclosure vulnerability. The application does not properly sanitize user-supplied input. An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site...

Nagios Login Panel - Detect

Nagios login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Nagios login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Nagios Login Panel - Detect', 'description': 'Nagios logi...

Exposed Prometheus Detection

Prometheus instance is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Prometheus instance is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Exposed Prometheus Detection', 'description': 'Prometheus...

Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect Detection

Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. !/usr/bin/env python3 -- coding: utf-8 -- """Polarisft Intellect Core Banking Software Version 9.""" import re from...

Ruby on Rails - Accept Header LFI Detection (CVE-2019-5418)

Detects CVE-2019-5418 by sending Accept: ../../../../../../../../etc/passwd and looking for passwd contents in the response. !/usr/bin/env python3 -- coding: utf-8 -- """Rails File Content Disclosure via Accept header CVE-2019-5418.""" import re from kittysploit import from...