Pallets Werkzeug <0.15.5 - Local File Inclusion

Pallets Werkzeug before 0.15.5 is susceptible to local file inclusion because SharedDataMiddleware mishandles drive names such as C: in Windows pathnames. id: CVE-2019-14322 info: name: Pallets Werkzeug 0.15.5 - Local File Inclusion author: madrobot severity: high description: | Pallets Werkzeug...

http-vuln-cve2019-14322.nse

http-vuln-cve2019-14322.nse Script NSE de Nmap para detectar CVE-2019-14322 de Pallets Werkzeug, que es un path traversal a través de SharedDataMiddleware que maneja incorrectamente nombres de unidades como C: en rutas de Windows. Descripción CVE-2019-14322 - Se encontró una vulnerabilidad en...

CVE-2019-14322-scanner

CVE-2019-14322-scanner Se encontró una vulnerabilidad en Pallets Werkzeug hasta la versión 0.15.4. Ha sido declarada como crítica. Esta vulnerabilidad afecta a la función SharedDataMiddleware del componente Windows. La manipulación con una entrada desconocida conduce a una vulnerabilidad de...

CVE-2019-14322

CVE-2019-14322 Modificación del exploit de faisalfs10x: PoC de CVE-2019-14322: Limitación inadecuada de un nombre de ruta a un directorio restringido 'Path Traversal' https://www.acunetix.com/vulnerabilities/web/odoo-lfi-cve-2019-14322/ https://nvd.nist.gov/vuln/detail/CVE-2019-14322 Descripción ...

Werkzeug-CVE-2022-29361-PoC

Werkzeug-CVE-2022-29361-PoC...

CVE-2023-49438

CVE-2023-49438 Prueba de concepto Descripción Una vulnerabilidad de redirección abierta en el paquete de Python Flask-Security-Too =versión 5.3.2 permite a los atacantes redirigir a usuarios desprevenidos a sitios maliciosos mediante una URL manipulada, abusando del parámetro ?next en las rutas...

CVE-2026-90583

A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the function index of the file app/sw.py of the component Query String Rendering. Performing a manipulation of the argument qs results in cross site scripting. The...

WerkGhost

WerkGhost Exploit para Werkzeug -p -d --timeout -t Ejemplo root@kitploit: python werkghost.py -u http://127.0.0.1:8000 -p CON -d download --timeout 3 -t 100...

CVE-2022-29361_Werkzeug_Client-Side-Desync-to-XSS

Créditos a @kevin-mizu https://github.com/kevin-mizu/Werkzeug-CVE-2022-29361-PoC/tree/main para más detalles lea: https://mizu.re/post/abusing-client-side-desync-on-werkzeug Probado en Chromium 119.0.6045.123 construido en Debian trixie/sid, ejecutándose en Debian kali-rolling...

CVE-2026-27199-werkzeug-safe-join-bypass-PoC

PoC CVE-2026-27199: Bypass de safejoin de Werkzeug mediante nombres de dispositivo de Windows Estado: Divulgado públicamente. Corregido en werkzeug 3.1.6. Gravedad: Moderada Reportero: @alimezar Aviso: GHSA-29vq-49wr-vm6x Versiones afectadas...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Browsers may allow “nameless” cookies that look like =value instead of key=value. A vulnerable browser may allow a compromised application on a neighboring subdomain to exploit this to set a cookie like =Host-test=bad for another subdomain...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. Prior to version 2.2.3, Werkzeug’s multipart form data parser would parse an unlimited number of parts, including file parts. These parts could be small amounts of data, but each part requires CPU time to parse, and may consume more memory...

Astra Linux – Vulnerability in Python-Werkzeug

Werkzeug is a comprehensive WSGI web application library. In affected versions of Werkzeug, the debugger can allow an attacker to execute code on a developer’s machine under certain circumstances. This requires the attacker to get the developer to interact with a domain and subdomain that they...

ROOT-APP-PYPI-CVE-2024-34069 CVE-2024-34069 in Werkzeug - Patched by Root

Root has patched CVE-2024-34069 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-46136 CVE-2023-46136 in Werkzeug - Patched by Root

Root has patched CVE-2023-46136 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-49767 CVE-2024-49767 in Werkzeug - Patched by Root

Root has patched CVE-2024-49767 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-25577 CVE-2023-25577 in Werkzeug - Patched by Root

Root has patched CVE-2023-25577 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

PYSEC-2026-3417 Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting. The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms,...

PYSEC-2026-1860 Werkzeug possible resource exhaustion when parsing file data in forms

Applications using Werkzeug to parse multipart/form-data requests are vulnerable to resource exhaustion. A specially crafted form body can bypass the Request.maxformmemorysize setting. The Request.maxcontentlength setting, as well as resource limits provided by deployment software and platforms,...

PYSEC-2026-2043 Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it...