secfixes-tracker

Alpine Security Fix Tracker This is a Flask web application which tracks security fixes in Alpine. By using the Alpine secdb, we can generally deduce which CVEs have and have not been fixed. Some extensions to the secfixes reporting schema will be added to allow package maintainers to denote fals...

flask_appengine_redirector

flaskappengineredirector Google App Engine Flask C2 redirector A simple Python Flask example application that's ready to run on App Engine. Development Setup Install SDK: https://cloud.google.com/sdk/docs/ Run dev instance: devappserver.py app.yaml Deploy gcloud app create gcloud app deploy Setup...

poastal

Poastal - la herramienta OSINT de correo electrónico Poastal es una herramienta OSINT de correo electrónico que proporciona información valiosa sobre cualquier dirección de correo electrónico. Con Poastal, puedes ingresar fácilmente una dirección de correo electrónico y responderá rápidamente a...

log4j-honeypot-flask

log4j-honeypot-flask Internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228 This can be installed on a workstation or server, either by running the Python app/app.py script directly you'll need python3, Flask, and Requests or as a Dock...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 testing environment and Nuclei template This repository contains a high-confidence Nuclei template to detect CVE-2021-21980 vSphere Web Client path traversal and a small mock environment that reproduces the vulnerable behavior for safe local testing. Files:...

EUVD-2026-55229

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-71241

CVE-2026-71241 affects a Book-Management-System built with Flask. Several endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) are missing the @login_required decorator that protects related routes (/search_student, /storage). This misconfiguration allows any unauthenticat...

Exploit for Improper Input Validation in Pyyaml

Seal Security — Python pip Example A minimal, intentionally...

CVE-2026-3962 Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting

A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function rendertemplate of the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py of the component Jinja2 Template...

Sensitive Information Exposure

Flask is vulnerable to Sensitive Information Exposure. The vulnerability is due to incomplete handling of the Vary: Cookie header when accessing the session object, where certain access patterns e.g., using the in operator fail to mark responses as user-specific, allowing caching proxies to store...

SQLi-Exfiltration-Lab

SQL Injection SQLi - Database Exfiltration Lab Overview...

SQLi

SQL Injection CTF Challenge - Quick Start Guide Files Over...

Simple-Flask-Deserialize-Demo-Exploit-Code

Simple-Flask-Deserialize-D...

Exploit for Code Injection in Langchain Langchain-Experimental

CVE-2024-21513 PoC for CVE-2024-21513 Original exploit documen...

Flask Weak Secret Key

Flask applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. When a weak or easily guessable application key is used, it compromises the security of the entire application. Attackers can potentially decrypt sensitive data,...

[SECURITY] Fedora 39 Update: python-flask-security-too-5.1.2-3.fc39

Flask-Security quickly adds security features to your Flask application...

CVE-2022-31509

The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

PYSEC-2021-123

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....

Cross site scripting

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....