WordPress Jannah Theme <5.4.4 - Cross-Site Scripting Detection

WordPress Jannah theme before 5.4.4 contains a reflected cross-site scripting vulnerability. It does not properly sanitize the options JSON parameter in its tiegetuserweather AJAX action before outputting it back in the page. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Jannah theme...

Exposed JSON Configuration Files Detection

Detects exposed JSON configuration files containing sensitive information including API keys, access tokens, AWS credentials, database configurations, base URLs, file paths, and application settings. These files often contain production configurations and credentials that should not be publicly...

eShop 3.0.4 - Cross-Site Scripting Detection

eShop 3.0.4 contains a reflected cross-site scripting vulnerability in json search parse and json response in wrteam.in. !/usr/bin/env python3 -- coding: utf-8 -- """eShop 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Google Service Json Detection

google-services.json internal file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """google-services.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Google Service Json Detection', 'description':...

Token Info Json File Detection

Detects Token Info Json File. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Token Info Json File.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Token Info Json File Detection', 'description': 'Detects Token...

JSON Web Key File - Exposure Detection

Searches for JSON Web Key JWK file. !/usr/bin/env python3 -- coding: utf-8 -- """Searches for JSON Web Key JWK file.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'JSON Web Key File - Exposure Detection',...

Json Server Detection

Detects Json Server. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Json Server.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Json Server Detection', 'description': 'Detects Json Server.', 'author':...

Oauth Credentials Json Detection

Oauth Credentials file is exposed. !/usr/bin/env python3 -- coding: utf-8 -- """Oauth Credentials file is exposed.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Oauth Credentials Json Detection', 'description':...

Gravity SMTP WordPress Plugin - Sensitive Information Exposure Detection

Gravity SMTP WordPress plugin = 2.1.4 contains a sensitive information exposure caused by an unrestricted REST API endpoint at /wp-json/gravitysmtp/v1/tests/mock-data, letting unauthenticated attackers retrieve detailed system configuration data, exploit requires no authentication. !/usr/bin/env...

Splunk <=7.0.1 - Information Disclosure Detection

Splunk through 7.0.1 is susceptible to information disclosure by appending raw/services/server/info/server-info?outputmode=json to a query, as demonstrated by discovering a license key. !/usr/bin/env python3 -- coding: utf-8 -- """Splunk through 7.""" from kittysploit import from...

ASP.NET Launch Settings - Exposure Detection

Detected exposed launchSettings.json files in ASP.NET Core applications. This file contains environment variables and launch configurations that may leak sensitive information. !/usr/bin/env python3 -- coding: utf-8 -- """Detected exposed launchSettings.""" from kittysploit import from...

Kubernetes API Server - YAML Parsing DoS (Billion Laughs) Detection

The Kubernetes API server is vulnerable to a denial of service attack via YAML/JSON parsing. An attacker can send a specially crafted YAML/JSON payload that causes exponential memory consumption Billion Laughs attack, leading to API server crash. !/usr/bin/env python3 -- coding: utf-8 -- """The...

WordPress Visualizer <3.3.1 - Cross-Site Scripting Detection

WordPress Visualizer plugin before 3.3.1 contains a stored cross-site scripting vulnerability via /wp-json/visualizer/v1/update-chart WP-JSON API endpoint. An unauthenticated attacker can execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard...

Adobe Experience Manager - Cross-Site Scripting Detection

Adobe Experience Manager contains a cross-site scripting vulnerability via requests using the selector childlist when the dispatcher does not respect the content-type responded by AEM and flips from application/json to text/html. As a consequence, the reflected suffix is executed and interpreted ...

Angular JSON File Exposure Detection

Detects Angular JSON File Exposure. !/usr/bin/env python3 -- coding: utf-8 -- """Detects Angular JSON File Exposure.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Angular JSON File Exposure Detection', 'description...

WordPress Themes Haberadam JSON API - IDOR and Path Disclosure Detection

This template is designed to detect a misconfiguration vulnerability in WordPress themes that use the Haberadam JSON API. This vulnerability can lead to an Insecure Direct Object Reference IDOR and path disclosure, potentially exposing sensitive information. !/usr/bin/env python3 -- coding: utf-8...

CVE-2026-59888

A flaw was found in jackson-databind. When Java Records use a PropertyNamingStrategy, an attacker can bypass the @JsonIgnore annotation during deserialization. This allows a renamed JSON key to be assigned to a Record constructor parameter, even if it was intended to be ignored. Consequently, an...

CVE-2026-57212

A flaw was found in RabbitMQ, a messaging and streaming broker. A remote attacker could exploit this vulnerability by sending oversized JSON bodies to the rabbitmqmanagement HTTP API. The API's body size check is incomplete, allowing the final combined size to exceed limits. This could lead to a...

CVE-2026-51298

A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the JsonParse object. Successful exploitation of this vulnerability can...

MAL-2026-11119 Malicious code in json-to-table-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2317bf7f973ca611fdd2215509ae94c302f868ae9fb5c5f00de0b6bd13fe3bc4 postinstall.js runs automatically on npm install and executes a shell pipeline via childprocess.exec that collects hostname, user, working directory,...