CVE-2026-108264

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2026-108258

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

GHSA-47C3-HPMG-7J6P Shiny for Python has path traversal in bookmark restore

Impact Shiny for Python's bookmark-restore path accepted a client-supplied stateid query-string value and joined it into the server-side bookmark directory /shinybookmarks/ without validating it. A value containing .. path segments, or an absolute path, could therefore cause the server to open an...

CVE-2026-108264 Wizarr: Authenticated Server-Side Template Injection (SSTI) in wizard step rendering leads to Remote Code Execution (RCE)

Wizarr is an advanced user invitation and management system for Jellyfin, Plex, Emby, and other media servers. Prior to 2026.9.1, wizard step Markdown supplied through the editor or imported bundles was evaluated by app/blueprints/wizard/routes.py in the application's non-sandboxed Jinja2...

CVE-2014-6271-IPFire

CVE-2014-6271 Python implementation of CVE-2014-6271: IP Fire =2.15 ShellShock RCE Based on the Metasploit module for the same exploit EDB ID: 34839 Exploit is automatic. See ./CVE-2014-6271.py --help for a full range of switches Warning: The code in this repository may be used for academic/ethic...

CVE-2026-25645

CVE-2026-25645 Insecure Temporary File Reuse in requests.utils.extractzippedpaths Executive Summary A vulnerability was identified in the requests library Python within the public utility function requests.utils.extractzippedpaths. The function utilizes a predictable, non-unique filename when...

CVE-2019-7609

CVE-2019-7609 Kibana Exploit for CVE-2019-7609 in python This exploit can give you RCE NOTE:- THIS IS THE MODIFIED VERSION Help Listening on port 4242 Running exploit Initial Access...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258 Shiny for Python - Path traversal in bookmark restore

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

EUVD-2026-95986

Shiny for Python is a framework for building interactive web applications in Python. From 1.4.0 until 1.6.4, bookmark restore accepts a client-supplied stateid and joins it into the server-side shinybookmarks directory without validating that it is a single safe path segment. An unauthenticated...

CVE-2026-108258

Shiny for Python versions 1.4.0 through 1.6.4 are vulnerable to a path traversal flaw in the bookmark restore functionality. The application fails to validate that the client-supplied state_id is a single safe path segment before joining it with the server-side shiny_bookmarks directory. This all...

ps5-pihost

PS5 Pi Host Use Raspberry Pi OS Lite 64-bit, Bookworm or newer with NetworkManager. A 64 GB SD card has ample room. This runs the existing Python host; do not flash the ESP32 binary to the Pi or its SD card. What this does The Pi creates a Wi-Fi network for the PS5. Its DHCP server assigns the...

motioneye-authenticated-RCE

RCE autenticado en MotionEye/MotionEyeOS Un script de Python 3 que sube un archivo tasks.pickle que permite RCE en MotionEye. Necesitas credenciales de administrador, así que no debería ser un gran problema. Desafortunadamente, MotionEye/MotionEyeOS se puede encontrar frecuentemente ejecutándose...

CVE-2014-0160-HeartBleed

This is the exploit for CVE-2014-0160 from exploitdb. It did not work for me on python3 while solving Valentine on hackthebox, so I have made the necessary changes. I am not the original author of this code...

creepy-plugins

creepy-plugins Descrizione Plugin per cree.py L'architettura di cree.py consente di utilizzare più sorgenti definite dall'utente per le informazioni di geolocalizzazione. Queste sorgenti sono definite come plugin e possono essere installate in creepy copiandole nella cartella plugins sotto la...

CVE-2025-55182

RSC Detector - React Server Components Vulnerability Scanner A Python-based security scanner for detecting and exploiting React Server Components RSC vulnerabilities in Next.js applications. This tool performs passive detection, active fingerprinting, and RCE exploitation testing. ⚠️ WARNING : Thi...

CVE-2022-22965

CVE-2022-22965 Exploit Of Spring4Shell! Usages python3 exploit.py Target Host...

AgentTesla-Config-Extractor

AgentTesla-Config-Extractor Config extractor for AgentTesla - Discord/Telegram Variant Usage agenttesla-config-extractor.py -f Example Output Example Hashes 0de25252f312735c0a26f7ac7a27cc8a51bfcdd900fc2e8d0a8b65013988e7e9 118a34bf096f5b9ea16c31de288793192ed4bc413ee8f50198eb7df7f5cf8f0e...

CVE-2022-29464

CVE-2022-29464 LOADER Install and execute the app on the server user@domain: pip3 install colored user@domain: git clone https://github.com/sh4den/CVE-2022-29464-loader.git user@domain: cd ./CVE-2022-29464-loader/ user@domain: python3 main.py Disclamer This repository is for academic purposes, th...