DNS-Shell

DNS-shell DNS-Shell es un Shell interactivo a través del canal DNS. El servidor está basado en Python y puede ejecutarse en cualquier sistema operativo que tenga Python instalado, el payload es un comando de PowerShell codificado. Entendiendo DNS-Shell El payload se genera cuando se invoca el...

Slackor

Slackor Mantenido en https://github.com/n00py/Slackor Un implante en Golang que usa Slack como canal de comando y control. Este proyecto fue inspirado por Gcat y Twittor. Esta herramienta se publica como prueba de concepto. Asegúrese de leer y comprender la Política de Desarrollador de Aplicacion...

Nimbo-C2

Nimbo-C2 Nimbo-C2 关于 功能 安装 简单方式 更简单的方式 使用 限制、警告、说明 贡献 关于 Nimbo-C2 是又一个（简单且轻量级的）C2框架。 Nimbo-C2 Agent支持x64 Windows和Linux。它用Nim编写，并在Windows上部分使用了.NET（通过动态加载CLR到进程中）。Nim很强大，但使用PowerShell与Windows交互更简单、更健壮，因此进行了这种组合。Linux Agent更精简，仅支持基本命令，包括使用memfd技术加载ELF文件。 所有服务器组件均用Python编写： HTTP监听器，管理Agent。...

DNS-Persist

DNS-Persist DNS-Persist es un agente de post-explotación que utiliza DNS para el comando y control. El código del lado del servidor está en Python y el agente está codificado en C++. Esta es la primera versión; se añadirán más funciones y mejoras en el futuro. Primeros pasos Autor 0x09AL -...

0net

0net: Sencillo backdoor de control remoto para Windows Introducción: 0net es un sencillo programa backdoor de control remoto para Windows. El cliente está escrito en C++ y compilado en VC++ 6.0. El servidor está escrito en Python y es multiplataforma. El proyecto se encuentra actualmente en...

Astra Linux – Vulnerability in Pypy, Jython

The documentation XML-RPC server in Python, from versions 2.7.16, 3.x through 3.6.9, and 3.7.x through 3.7.4, has XSS vulnerabilities due to the servertitle field. This issue occurs in Lib/DocXMLRPCServer.py in Python 2.x, and in Lib/xmlrpc/server.py in Python 3.x. If the setservertitle function ...

CVE-2026-61433 PraisonAI before 4.6.78 Code Injection via API deployment generator

PraisonAI before 4.6.78 fails to safely encode deployment configuration values when generating Python source code for API servers. Attackers can inject arbitrary Python expressions through the deploy.api.host and agentsfile configuration parameters that execute when the generated server starts or...

GHSA-X8CV-XMQ7-P8XP PraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints

PraisonAI AgentTeam.launch exposes unauthenticated remote agent invocation endpoints Summary PraisonAI's documented Python AgentTeam.launch / Agents.launch HTTP server starts externally reachable agent invocation endpoints without any authentication enforcement. The current implementation registe...

EUVD-2026-34037

A vulnerability was found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The affected element is the function requests.get of the file src/blendermcp/server.py of the component ZIP File Handler. The manipulation of the argument zipfileurl results in server-side request...

CVE-2026-42545 Granian: DoS via WSGI response header panic

Granian is a Rust HTTP server for Python applications. From 0.2.0 to 2.7.4, Granian aborts a worker process if a WSGI application returns an invalid HTTP response header name or value. The WSGI response conversion path uses .unwrap on both the header name and header value constructors, so malform...

PT-2026-26217

Name of the Vulnerable Software and Affected Versions NLTK versions 3.9.3 and prior Description NLTK Natural Language Toolkit contains a reflected cross-site scripting XSS issue in the lookup ... route of nltk.app.wordnet app. A crafted lookup URL can inject arbitrary HTML/JavaScript into the...

[SECURITY] Fedora 43 Update: python-socketio-5.14.2-1.fc43

Socket.IO is a transport protocol that enables real-time bidirectional event-based communication between clients typically, though not always, web browsers and a server. The official implementations of the client and server components are written in JavaScript. This package provides Python...

EUVD-2008-0989

Malware in sbrugna...

EUVD-2008-0987

Malware in sbrugna...

EUVD-2025-7124

Malicious code in bioql PyPI...

Exploit for Path Traversal in Citrix Application_Delivery_Controller_Firmware

PoC exploit for CVE-2019-19781, a vulnerability in Citrix Application Delivery Controller ADC and Gateway. The repository, CitrixHoneypot, is a honeypot designed to detect and log scan and exploitation attempts for this vulnerability. The tool is written in Python and uses the http.server module ...

Denial Of Service (DoS)

litellm is vulnerable to Denial of Service DoS. The vulnerability is due to the use of ast.literaleval to parse user input, allowing an attacker to send specially crafted input that crashes the litellm Python server...

Exploit for Cross-site Scripting in Warfareplugins Social_Warfare

CVE-2019-9978 - Social Warfare WordPress Plugin RCE system'ca...

CVE-2024-10188

A vulnerability in BerriAI/litellm, as of commit 26c03c9, allows unauthenticated users to cause a Denial of Service DoS by exploiting the use of ast.literaleval to parse user input. This function is not safe and is prone to DoS attacks, which can crash the litellm Python server...

CVE-2024-10955

A Regular Expression Denial of Service ReDoS vulnerability exists in gaizhenbiao/chuanhuchatgpt, as of commit 20b2e02. The server uses the regex pattern r'+' to parse user input. In Python's default regex engine, this pattern can take polynomial time to match certain crafted inputs. An attacker c...