Exploit for Code Injection in Langflow

POC - Remote and unauthenticated attacker can send crafted HTT...

Langflow /api/v1/validate/code command injection

Added: 04/11/2025 CVE: CVE-2025-3248 Background Langflow is a low-code tool for building AI agents and workflows. Problem A command injection vulnerability in the /api/v1/validate/code API endpoint could allow a remote unauthenticated attacker to execute arbitrary commands by sending a specially...

Exploit for Code Injection in Langflow

CVE-2025-3248-POC POC of CVE-2025-...

CVE-2025-3248

Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...

CVE-2024-3248

In Xpdf 4.05 and earlier, a PDF object loop in the attachments leads to infinite recursion and a stack overflow...

UBUNTU-CVE-2024-3248

In Xpdf 4.05 and earlier, a PDF object loop in the attachments leads to infinite recursion and a stack overflow...

CVE-2024-3248

In Xpdf 4.05 and earlier, a PDF object loop in the attachments leads to infinite recursion and a stack overflow...

CVE-2022-3248

creationtimestamp| type| source ---|---|--- 2023-10-05 18:12:43+00:00| seen| https://t.me/cibsecurity/71666...

CVE-2022-3248

OpenShift API admission checks do not enforce the “custom-host” permissions, allowing boundary violations since permissions are not applied. This CVE is described in multiple sources (NVD, Red Hat, OSV, CVE List, PRION, etc.) with no explicit affected versions or published patch details in the su...

SUSE SLED15: gstreamer-plugins-good / gstreamer-plugins-good-32bit / etc (SUSE-SU-2023:3248-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3248-1 advisory. - CVE-2023-37327: Fixed FLAC file parsing integer overflow remote code execution vulnerability. bsc121312...

CVE-2023-3248 All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting

The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2023-3248

The CVE-2023-3248 entry concerns the All-in-one Floating Contact Form WordPress plugin prior to version 2.1.2, which does not adequately sanitise and escape certain settings. The vulnerability enables Stored Cross-Site Scripting (XSS) by an admin or other high-privileged user, even when unfiltere...

CVE-2023-3248 All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting

The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

WordPress All-in-one Floating Contact Form – My Sticky Elements Plugin < 2.1.2 is vulnerable to Cross Site Scripting (XSS)

Software All-in-one Floating Contact Form – My Sticky Elements Type Plugin Vulnerable versions 2.1.2 Fixed in 2.1.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3248 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID...

RHEL 9 : git (RHSA-2023:3248)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3248 advisory. Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a...

SUSE CVE-2015-3248

openhpi/Makefile.am in OpenHPI before 3.6.0 uses world-writable permissions for /var/lib/openhpi directory, which allows local users, when quotas are not properly setup, to fill the filesystem hosting /var/lib and cause a denial of service disk consumption...

SUSE: Security Advisory (SUSE-SU-2016:3248-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-3248

Cisco UCS Director and Cisco UCS Director Express for Big Data expose multiple REST API vulnerabilities (CVE-2020-3248 and related CVEs) that may allow a remote attacker to bypass authentication or perform directory traversal. Root cause: insufficient validation of user input in REST API paths (e...

Oracle Weblogic Server Deserialization RCE - RMI UnicastRef

An unauthenticated attacker with network access to the Oracle Weblogic Server T3 interface can send a serialized object sun.rmi.server.UnicastRef to the interface to execute code on vulnerable hosts. This module requires Metasploit: https://metasploit.com/download Current source:...

Oracle WebLogic 12.1.2.0 RMI Registry UnicastRef Object Java Deserialization Remote Code Execution

Exploit for multiple platform in category web applications !/usr/bin/python -- coding: utf-8 -- from argparse import RawTextHelpFormatter import socket, argparse, subprocess, ssl, os.path HELPMESSAGE = ''' --------------------------------------------------------------------------------------...