79 matches found
CVE-2026-34954
PraisonAI is a multi-agent teams system. Prior to version 1.5.95, FileTools.downloadfile in praisonaiagents validates the destination path but performs no validation on the url parameter, passing it directly to httpx.stream with followredirects=True. An attacker who controls the URL can reach any...
CVE-2026-34936
PraisonAI is a multi-agent teams system. Prior to version 4.5.90, passthrough and apassthrough in praisonai accept a caller-controlled apibase parameter that is concatenated with endpoint and passed directly to httpx.Client.request when the litellm primary path raises AttributeError. No URL schem...
Malicious code in request-httpx-9 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d8547656202b4eac0d914d466c2fe1d3bf17210c63af75ac2d8e020f5d0ef28c The package contains a Telegram bot running allowing for remote access. This functionality is disclosed in the readme, but the package name clearly indicates...
Exploit for CVE-2024-25600
🧱 BrickBreaker !Pythonhttps://img.shields.io/badge/Pytho...
EUVD-2022-0122
Malicious code in bioql PyPI...
Malicious code in fast-httpx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43be59be9c0005970f6a8a0cb80767f019ee690c675e81e7a40ed5672a175d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview fast-httpx is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
MAL-2025-47463 Malicious code in fast-httpx (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43be59be9c0005970f6a8a0cb80767f019ee690c675e81e7a40ed5672a175d64 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2021-41945
Encode OSS httpx 0.23.0 is affected by improper input validation in httpx.URL, httpx.Client and some functions using httpx.URL.copywith...
MAL-2025-3448 Malicious code in httpx-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d26dbf9fa1035b8b1e189f67123ee22f506cd21c08e17c282176a716af9da033 Importing the module starts downloading and executing first a script, and then a widely identified malware Packages are used as dependencies in a GitHub projec...
Malicious code in httpx-client (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d26dbf9fa1035b8b1e189f67123ee22f506cd21c08e17c282176a716af9da033 Importing the module starts downloading and executing first a script, and then a widely identified malware Packages are used as dependencies in a GitHub projec...
Exploit for Missing Authentication for Critical Function in Cyberpanel
cve-2024-51567-poc Simplified Description Vulner...
CyberPanel upgrademysqlstatus Arbitrary Command Execution
import httpx import sys def getCSRFtokenclient: resp = client.get"/" return resp.cookies'csrftoken' def pwnclient, CSRFtoken, cmd: headers = "X-CSRFToken": CSRFtoken, "Content-Type":"application/json", "Referer": strclient.baseurl payload = '"statusfile":"/dev/null; %s; ","csrftoken":"%s"' % cmd,...
Exploit for Missing Authentication for Critical Function in Cyberpanel
CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python...
MAL-2024-12269 Malicious code in faest (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781 When using this library to do any request, a "validateorigin" function is called L1320 in client.py. This method, located in utils.py, collects all request dat...
Malicious code in faest (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f66b290465d72fc55bce4fef4200ebea68c430be84cdcbbabec5263958041781 When using this library to do any request, a "validateorigin" function is called L1320 in client.py. This method, located in utils.py, collects all request dat...
Malicious code in qaxtest-httpx (PyPI)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-5840 Malicious code in qaxtest-httpx (PyPI)
--- -= Per source details. Do not edit below this line.=-...