Sami Mokaddem

33 exploits Active since Feb 2022
CVE-2026-66918 WRITEUP HIGH WRITEUP
DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons
Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker able to influence graph data can provide crafted markup containing executable event handlers, such as an <image> element with an onerror attribute. When a victim loads or renders the malicious graph, the payload may execute arbitrary JavaScript in the security context of the application embedding Pivotick. Successful exploitation could allow the attacker to access application data available to the victim, modify displayed content, or perform actions using the victim’s authenticated session. Exploitation requires an application using Pivotick to render graph data that is controlled or modified by an attacker.
CVE-2026-66919 WRITEUP MEDIUM WRITEUP
Stored DOM-Based Cross-Site Scripting in Node Modal Headers
Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious HTML or JavaScript payload into a node’s label or description. The payload would be parsed and executed in the application’s origin when a user opened the affected node’s inspect or edit modal. Successful exploitation could allow the attacker to access information available to the victim, modify application data, or perform actions using the victim’s active session. The vulnerability has been addressed by creating the modal elements without embedding graph data in HTML and assigning node labels and descriptions through textContent.
CVE-2026-66920 WRITEUP HIGH WRITEUP
Pivotick - Stack Exhaustion Denial of Service via Deep or Cyclic Graph Data
Pivotick contains an uncontrolled-recursion vulnerability when processing caller-supplied graph and node data. The affected graph algorithms recursively traversed graph edges, while the JSON viewer recursively processed each level of a node’s data structure. A specially crafted graph containing an excessively long path, deeply nested properties, or circular object references could therefore exhaust the JavaScript call stack when Pivotick calculates a layout or displays a node in the inspection modal. Successful exploitation may cause an uncaught exception, freeze the affected page, or crash the browser tab, resulting in a client-side denial of service. No confidentiality or integrity impact has been identified. The patch replaces the recursive graph traversals with iterative stack-based implementations and limits the reachability calculation to 1,000,000 edge traversals. It also limits JSON rendering to 64 levels and detects circular references before descending further into an object.
CVE-2026-66921 WRITEUP MEDIUM WRITEUP
Pivotick - Stored DOM-Based Cross-Site Scripting via Unescaped Markdown Node References
Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated <span> element. Because the node-reference tokenizer rejected only square brackets, a crafted node name could still contain quotation marks, angle brackets, or other HTML metacharacters. An attacker could therefore terminate the quoted attribute or inject additional HTML elements and event-handler attributes. When malicious node-reference content is rendered by a consumer that does not apply DOMPurify or equivalent sanitization, arbitrary JavaScript may execute in the victim’s browser in the security context of the application. Successful exploitation requires a victim to open or render a crafted graph or note and could allow the attacker to access same-origin information, modify displayed content, or perform actions using the victim’s session. The patch resolves the issue by applying context-appropriate HTML escaping to node names before inserting them into either HTML text or quoted attribute values. The shared escaping function now encodes ampersands, angle brackets, and both types of quotation marks.
CVE-2026-66922 WRITEUP MEDIUM WRITEUP
Pivotick 1.4.0 - Prototype Pollution Graph Manipulation and Denial of Service
Pivotick used plain JavaScript objects as lookup tables indexed by caller-controlled graph node identifiers in its tree-layout and cycle-detection components. Node identifiers matching properties inherited from Object.prototype, such as constructor, toString, or __proto__, were not handled as ordinary identifiers. These values could be interpreted as existing inherited properties, resolve to values of an unexpected type, or—in the case of __proto__ assignments—modify the prototype of an internal lookup object. An attacker who can supply graph data containing crafted node identifiers could consequently cause nodes or edges to be silently omitted, produce incorrect hierarchy levels, bypass or corrupt cycle-detection results, or trigger an exception that interrupts graph processing and rendering. This affects the integrity of graph visualisations and analytics and may cause a client-side denial-of-service condition. The affected code also failed to safely handle edges whose source node was absent from the supplied node set. Furthermore, calculating the maximum tree depth by spreading all level values into Math.max() could exceed the JavaScript function-argument limit when processing a sufficiently large graph, resulting in an exception and denial of service. The patch replaces identifier-keyed plain objects with Map instances, ignores invalid edges during tree construction, and calculates the maximum depth iteratively.
CVE-2026-67173 WRITEUP MEDIUM WRITEUP
Pivotick Unvalidated Node Image URLs Allow Unintended Client-Side Requests
Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An attacker able to supply crafted graph data could set an image path to a malicious URI. When a victim rendered the affected graph, the browser could resolve the attacker-controlled URI and initiate an unintended request or invoke scheme-specific handling in the victim’s context. Depending on the URI, browser behaviour, and installed protocol handlers, exploitation could disclose limited client or network metadata, facilitate rendering-based tracking, or attempt to access local or internal resources. Exploitation requires a victim to load or render graph data containing the malicious imagePath. The patch normalizes ASCII whitespace and control characters in URI schemes and restricts image paths to relative URLs or the http, https, data, and blob schemes.
CVE-2026-67174 WRITEUP CRITICAL WRITEUP
DOM-Based Cross-Site Scripting via Unsafe String and SVG Icon Rendering in Pivotick
Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHTMLElement function treated any resolved string as HTML markup by assigning it to a <template> element through innerHTML. Strings derived from untrusted graph properties or custom rendering callbacks could therefore introduce arbitrary HTML or SVG elements into the live document. The vulnerable function was used by multiple UI components, including headers, property panels, extra panels, and tooltips. Additionally, createIcon inserted caller-supplied svgIcon markup into a template without sanitization. An application integrating Pivotick and deriving icon markup from untrusted data could therefore expose a second script-execution path. An unauthenticated attacker able to provide a crafted graph, property value, rendering result, or SVG icon could execute JavaScript in another user's browser when the affected content is displayed or interacted with. Successful exploitation could allow the attacker to access information available to the victim, manipulate graph data or application state, and perform actions with the victim's privileges. The patch changes string rendering to use textContent, requiring callers to explicitly return an Element when HTML rendering is intended. It also sanitizes SVG icon markup before inserting it into the DOM.
CVE-2026-66825 WRITEUP MEDIUM WRITEUP
Cross-Site Scripting via Unsafe URL Schemes in Pivotick Property Links
Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence node or edge property data could provide a malicious value using the javascript: scheme, including variants obfuscated with whitespace or control characters. If a user clicked the generated property link, attacker-controlled JavaScript could execute in the context of the Pivotick application. Successful exploitation could allow the attacker to access information available to the victim’s browser session or perform actions with the victim’s privileges. The vulnerability was addressed by normalizing property values and preventing URLs with non-allowlisted schemes from being rendered as clickable links.
CVE-2026-60124 WRITEUP MEDIUM WRITEUP
MISP importModule missing authorization allows read-only users to modify events via misp_standard imports
An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to events they were not allowed to modify. When an import module returned results in the misp_standard format, the write path did not verify event modification rights before saving the module output. This could allow a view-only user to inject or alter event data, impacting the integrity of MISP event content. The issue was fixed by enforcing the same modification-rights check used by related module result handling paths before processing misp_standard imports.
CVE-2026-60125 WRITEUP MEDIUM WRITEUP
importModule function in MISP ignores per-organisation import module restrictions
MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was not allowed to use a module restricted via Plugin.Import_<module>_restrict could still invoke that import module directly if they knew its name. This could allow unauthorised access to restricted import-module functionality and, depending on the module and the user’s event permissions, may allow unauthorised import or modification of event data through a module that should have been unavailable to the user’s organisation.
CVE-2022-25321 WRITEUP MEDIUM WRITEUP
cerebrate < 1.4 - Cross-Site Scripting in Bookmarks Component
An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
CVSS 6.1
CVE-2022-25321 WRITEUP MEDIUM WRITEUP
cerebrate < 1.4 - Cross-Site Scripting in Bookmarks Component
An issue was discovered in Cerebrate through 1.4. XSS could occur in the bookmarks component.
CVSS 6.1
CVE-2022-42724 WRITEUP MEDIUM WRITEUP
MISP < 2.4.164 - Incorrect Authorization in UsersController
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).
CVSS 4.3
CVE-2023-24026 WRITEUP MEDIUM WRITEUP
MISP 2.4.167 - Stored Cross-Site Scripting in Event-Graph Preview
In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
CVSS 6.1
CVE-2023-24027 WRITEUP MEDIUM WRITEUP
MISP 2.4.167 - Stored Cross-Site Scripting via Network History Name
In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.
CVSS 6.1
CVE-2023-24028 WRITEUP CRITICAL WRITEUP
MISP <2.4.167 - Privilege Escalation
In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
CVSS 9.8
CVE-2023-24070 WRITEUP MEDIUM WRITEUP
MISP < 2.4.167 - Cross-Site Scripting via Referer Field in AuthKey Add
app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
CVSS 6.1
CVE-2023-26468 WRITEUP CRITICAL WRITEUP
cerebrate 1.12 - Unauthenticated API Key Creation via Missing Organisation ID Check
Cerebrate 1.12 does not properly consider organisation_id during creation of API keys.
CVSS 9.1
CVE-2023-28606 WRITEUP MEDIUM WRITEUP
MISP < 2.4.169 - Cross-Site Scripting via Event-Graph Node Tooltips
js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips.
CVSS 6.1
CVE-2023-28607 WRITEUP MEDIUM WRITEUP
MISP < 2.4.169 - Cross-Site Scripting in Event-Graph Relationship Tooltip
js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip.
CVSS 6.1
CVE-2023-28883 WRITEUP CRITICAL WRITEUP
Cerebrate 1.13 - Blind SQL Injection via SearchAll API Endpoint
In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
CVSS 9.8
CVE-2023-28884 WRITEUP MEDIUM WRITEUP
MISP 2.4.169 - Cross-Site Scripting in Community Index
In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
CVSS 6.1
CVE-2023-37307 WRITEUP MEDIUM WRITEUP
MISP < 2.4.172 - Stored Cross-Site Scripting in title_for_layout
In MISP before 2.4.172, title_for_layout is not properly sanitized in Correlations, CorrelationExclusions, and Layouts.
CVSS 5.4
CVE-2023-40224 WRITEUP MEDIUM WRITEUP
MISP 2.4.174 - Cross-Site Scripting in Events Index View
MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
CVSS 6.1
CVE-2023-41908 WRITEUP MEDIUM WRITEUP
cerebrate < 1.15 - Missing Secure Attribute for Session Cookie
Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
CVSS 5.3