Splunk <=7.0.1 - Information Disclosure Detection

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk through 7.""" from kittysploit import from...

Angular JSON File Exposure Detection

Detects Angular JSON File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Angular JSON File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Angular JSON File Exposure Detection', 'description...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure Detection

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. !/usr/bin/env...

WordPress Themes Haberadam JSON API - IDOR and Path Disclosure Detection

This template is designed to detect a misconfiguration vulnerability in WordPress themes that use the Haberadam JSON API. This vulnerability can lead to an Insecure Direct Object Reference IDOR and path disclosure, potentially exposing sensitive information. !/usr/bin/env python3 -- coding: utf-8...

Json Server Detection

Detects Json Server. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Json Server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Json Server Detection', 'description': 'Detects Json Server.', 'author':...

Oauth Credentials Json Detection

Oauth Credentials file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Oauth Credentials file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oauth Credentials Json Detection', 'description':...

Crestron Device - Credentials Disclosure Detection

An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. Specifically, aj.html sends a JSON document with uname...

eShop 3.0.4 - Cross-Site Scripting Detection

eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in. !/usr/bin/env python3 -- coding: utf-8 -- """eShop 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

CVE-2026-59888

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

CVE-2026-57212

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmqmanagement HTTP API. The API's body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a...

CVE-2026-51298

A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the JsonParse object. Successful exploitation of this vulnerability can...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...

PT-2026-65611

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions 0.52.1 through 0.60.1 Description When using Pydantic v2 output mode, the software improperly handles data from the --extra-template-data file. Specifically, the process validators function in src/datamodel co...

PT-2026-65659

Summary datamodel-code-generator honours a custom x-python-type JSON-Schema extension that lets a schema author override the generated Python type for a field. The value is forwarded verbatim into the generated Python source as the field annotation, with a single sanitisation pass that is trivial...

PT-2026-65614

Name of the Vulnerable Software and Affected Versions datamodel-code-generator versions prior to 0.62.0 Description An unauthenticated path traversal and information disclosure issue exists when the software resolves JSON Schema $ref targets. The application fails to restrict these targets to the...

CVE-2026-55389: Improper Limitation of a Pathname to a Restricted Directory

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. Prior to 0.62.0, datamodel-code-generator resolves JSON Schema $ref targets in...

CVE-2026-66920: Uncontrolled Recursion

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...

Linux Distros Unpatched Vulnerability : CVE-2026-51297

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sqlite 3.41 has a use-after-free vulnerability in the JSON parsing logic. Remote adversaries can craft malicious JSON payload to trigger memory free followed by...

PT-2026-65514

Name of the Vulnerable Software and Affected Versions Pterodactyl Panel versions prior to 1.12.3 Pterodactyl Wings versions prior to 1.12.2 Description A privilege escalation issue exists in the Wings '/upload/file' endpoint. The system accepts any valid panel-signed JSON Web Token JWT containing...

PT-2026-65483

Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing a...