secfixes-tracker

Alpine Security Fix Tracker This is a Flask web application which tracks security fixes in Alpine. By using the Alpine secdb, we can generally deduce which CVEs have and have not been fixed. Some extensions to the secfixes reporting schema will be added to allow package maintainers to denote fals...

poastal

Poastal - 电子邮件 OSINT 工具 Poastal 是一个电子邮件 OSINT 工具，能提供任何电子邮件地址的有价值信息。使用 Poastal，您可以轻松输入一个电子邮件地址，它会迅速回答几个问题，为您提供关键信息。 ✨ 功能特性 确定拥有该电子邮件的人员姓名。 检查电子邮件是否可投递。 查明电子邮件是否为临时邮箱。 识别该电子邮件是否被视为垃圾邮件。 检查该电子邮件是否在热门平台（如 Facebook、Twitter、Snapchat、Parler、Rumble、MeWe、Imgur、Adobe、Wordpress 和 Duolingo）上注册。 💻 使用说明...

flask_appengine_redirector

flaskappengineredirector Google App Engine Flask C2 重定向器 一个简单的 Python Flask 示例应用，已准备好部署到 App Engine 上运行。 开发设置 安装 SDK：https://cloud.google.com/sdk/docs/ 运行开发实例：devappserver.py app.yaml 部署 gcloud app create gcloud app deploy 设置 将调试输出设置为日志输出（默认为 True： 设置转发 C2 域名（要重定向到的位置）： 设置重定向器域名（传入域名）：...

log4j-honeypot-flask

log4j-honeypot-flask Internal network honeypot for detecting if an attacker or insider threat scans your network for log4j CVE-2021-44228 This can be installed on a workstation or server, either by running the Python app/app.py script directly you'll need python3, Flask, and Requests or as a Dock...

cve-2021-21980-mock-server

Clippy of the Dead - CVE-2021-21980 testing environment and Nuclei template This repository contains a high-confidence Nuclei template to detect CVE-2021-21980 vSphere Web Client path traversal and a small mock environment that reproduces the vulnerable behavior for safe local testing. Files:...

EUVD-2026-55229

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-72577 NASA fprime-gds - Missing Authentication and Path Traversal Enable Unauthenticated RCE and Spacecraft Command Injection

Multiple vulnerabilities in NASA fprime-gds through 3.4.3 allow an unauthenticated remote attacker to achieve arbitrary code execution on the ground station host and inject arbitrary commands to connected spacecraft. The Flask application in src/fprimegds/flask/app.py applies no authentication to...

CVE-2026-71241

CVE-2026-71241 affects a Book-Management-System built with Flask. Several endpoints (/student, /record, /books, /find_stu_book, /find_not_return_book) are missing the @login_required decorator that protects related routes (/search_student, /storage). This misconfiguration allows any unauthenticat...

Exploit for Improper Input Validation in Pyyaml

Seal Security — Python pip Example A minimal, intentionally...

CVE-2026-3962 Jcharis Machine-Learning-Web-Apps Jinja2 Template app.py render_template cross site scripting

A vulnerability was identified in Jcharis Machine-Learning-Web-Apps up to a6996b634d98ccec4701ac8934016e8175b60eb5. The impacted element is the function rendertemplate of the file Machine-Learning-Web-Apps-master/Build-n-Deploy-Flask-App-with-Waypoint/app/app.py of the component Jinja2 Template...

Sensitive Information Exposure

Flask is vulnerable to Sensitive Information Exposure. The vulnerability is due to incomplete handling of the Vary: Cookie header when accessing the session object, where certain access patterns e.g., using the in operator fail to mark responses as user-specific, allowing caching proxies to store...

SQLi-Exfiltration-Lab

SQL Injection SQLi - Database Exfiltration Lab Overview...

SQLi

SQL Injection CTF Challenge - Quick Start Guide Files Over...

Simple-Flask-Deserialize-Demo-Exploit-Code

Simple-Flask-Deserialize-D...

Exploit for Code Injection in Langchain Langchain-Experimental

CVE-2024-21513 PoC for CVE-2024-21513 Original exploit documen...

Flask Weak Secret Key

Flask applications use an application key to encrypt and sign various data, including session cookies and other sensitive information. When a weak or easily guessable application key is used, it compromises the security of the entire application. Attackers can potentially decrypt sensitive data,...

[SECURITY] Fedora 39 Update: python-flask-security-too-5.1.2-3.fc39

Flask-Security quickly adds security features to your Flask application...

CVE-2022-31509

The iedadata/usap-dc-website repository through 1.0.1 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

PYSEC-2021-123

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....

Cross site scripting

The Python "Flask-Security-Too" package is used for adding security features to your Flask application. It is an is an independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. All versions of Flask-Security-Too allow redirects after many successful views e....