144 matches found
CVE-2015-4133
CVE-2015-4133 root@kitploit: usage: CVE-2015-4133.py -h --RHOST RHOST --RPORT RPORT -v YEAR MONTH FILE ReFlex Gallery WordPress plugin = 3.1.3 CVE-2015-4133 PoC. Reference: https://nvd.nist.gov/vuln/detail/CVE-2015-4133 positional arguments: YEAR wp-content/uploads sub directory MONTH...
CVE-2015-4133
CVE-2015-4133 CVE 2015-4133 - Reflex Gallery 3.1.3 任意ファイルアップロードによるRCE 説明 Reflex Gallery は WordPress プラグインであり、その 3.1.3 バージョンには、攻撃者が任意のファイル（例えば PHP コード）をアップロードしてリモートコマンド実行を達成できる脆弱性があります。 root@kitploit: Exploit Title: Wordpress Plugin Reflex Gallery - Arbitrary File Upload Google Dork:...
PYSEC-2026-1868 reflex-dev/reflex has an Open Redirect vulnerability
Mitigation Make sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct: assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description --- Vulnerability Overview - When the GET /auth-codespace page loads in a GitHub...
reflex-dev/reflex has an Open Redirect vulnerability
MitigationMake sure GITHUBCODESPACESPORTFORWARDINGDOMAIN is not set in a production environment. So the following is correct:assert os.getenv"GITHUBCODESPACESPORTFORWARDINGDOMAIN" is None Vulnerability Description---Vulnerability Overview - When theGET/auth-codespace page loads in a GitHub...
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
SummaryIn backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push.The CLI accepts two operator-facing...
PYSEC-2026-291 Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...
EUVD-2026-37516
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication...
Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication
Summary In backpropagate = 1.1.0, the optional Reflex web UI pip install backpropagateui, launched via backprop ui exposes a training control plane: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and HuggingFace Hub push. The CLI accepts two operator-facing...
CVE-2026-48797
Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and...
CVE-2026-48797: Improperly Implemented Security Check for Standard
Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration, GGUF export, and...
PT-2026-50132
Name of the Vulnerable Software and Affected Versions Backpropagate versions 1.1.0 through 1.1.1 Description The optional Reflex web UI exposes a training control plane without authentication, despite CLI flags --auth and --share suggesting that security controls are active. The Reflex backend...
CVE-2026-42544 vulnerabilities
Vulnerabilities for packages: reflex...
GHSA-F5P7-9FR5-8JMJ vulnerabilities
Vulnerabilities for packages: reflex...
CVE-2026-42545 vulnerabilities
Vulnerabilities for packages: reflex...
GHSA-VRG7-482J-P6F6 vulnerabilities
Vulnerabilities for packages: reflex...
CVE-2026-44307 vulnerabilities
Vulnerabilities for packages: mlflow, reflex, airflow...
GHSA-2H4P-VJRC-8XPQ vulnerabilities
Vulnerabilities for packages: mlflow, reflex, airflow...
CVE-2026-42545 vulnerabilities
Vulnerabilities for packages: reflex, litellm...