CVE-2026-66920

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-66920

Pivotick is affected by an uncontrolled-recursion vulnerability in its graph processing and JSON viewer components. The issue arises when processing caller-supplied graph and node data, where recursive traversals over edges and node structures can exhaust the JavaScript call stack on specially cr...

EUVD-2026-49796

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-66920

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

CVE-2026-66920 Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

Malicious code in json-to-table-util (npm)

Source: ossf-package-analysis 63ee08885a126855fbc96dbbb6f8c4ef903d9dc8f2cb02fe0fa178a7db1ed904 The OpenSSF Package Analysis project identified 'json-to-table-util' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious Package

Overview json-to-table-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

WordPress PayPal Pro <1.1.65 - SQL Injection Detection

WordPress PayPal Pro plugin before 1.1.65 is susceptible to SQL injection via the 'query' parameter which allows for any unauthenticated user to perform SQL queries with the results output to a web page in JSON format. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress PayPal Pro plugin befor...

Kubernetes API Server - YAML Parsing DoS (Billion Laughs) Detection

The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. !/usr/bin/env python3 -- coding: utf-8 -- """The...

JSON Web Key File - Exposure Detection

Searches for JSON Web Key JWK file. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for JSON Web Key JWK file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JSON Web Key File - Exposure Detection',...

WordPress Visualizer <3.3.1 - Cross-Site Scripting Detection

WordPress Visualizer plugin before 3.3.1 contains a stored cross-site scripting vulnerability via /wp-json/visualizer/v1/update-chart WP-JSON API endpoint. An unauthenticated attacker can execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard...

Exposed JSON Configuration Files Detection

Detects exposed JSON configuration files containing sensitive information including API keys, access tokens, AWS credentials, database configurations, base URLs, file paths, and application settings. These files often contain production configurations and credentials that should not be publicly...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted ...

Satellian Intellian Aptus Web <= 1.24 - Remote Command Execution Detection

Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NOTE: a valid sid cookie for a login to the intellian default account might be needed. !/usr/bin/env python3 -- coding: utf-8 -- """Intellian Aptus W...

Google Service Json Detection

google-services.json internal file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """google-services.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Service Json Detection', 'description':...

Token Info Json File Detection

Detects Token Info Json File. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Token Info Json File.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Token Info Json File Detection', 'description': 'Detects Token...

ASP.NET Launch Settings - Exposure Detection

Detected exposed launchSettings.json files in ASP.NET Core applications. This file contains environment variables and launch configurations that may leak sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed launchSettings.""" from kittysploit import from...

WordPress Jannah Theme <5.4.4 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme...