Server-side Request Forgery (SSRF)

Overview streamlit is a The fastest way to build data apps in Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to improper validation of filesystem paths in the ComponentRequestHandler process. An attacker can trigger outbound SMB authentication...

PT-2026-28176

Name of the Vulnerable Software and Affected Versions Streamlit versions prior to 1.54.0 Description Streamlit Open Source versions running on Windows hosts are affected by an unauthenticated Server-Side Request Forgery SSRF issue. This arises from insufficient validation of filesystem paths...

SQL_ARES_LZL

SQL ARES LZL - Suite de Inyección SQL Avanzada ARES LZL...

CVE-2024-41116

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 1254 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 1345, leading to remote code...

CVE-2024-41112

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the palette variable in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 380, leading to remote code execution. Commit...

CVE-2024-41117

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 115 in pages/10🌍EarthEngineDatasets.py takes user input, which is later used in the eval function on line 126, leading to remote...

CVE-2024-41113

streamlit-geospatial is a streamlit multipage app for geospatial applications. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the visparams variable on line 383 or line 390 in pages/1📷Timelapse.py takes user input, which is later used in the eval function on line 395, leading to remote...

EUVD-2023-0247

Malicious code in bioql PyPI...

EUVD-2024-38936

Malicious code in bioql PyPI...

EUVD-2024-38934

Malicious code in bioql PyPI...

EUVD-2024-0164

Malicious code in bioql PyPI...

EUVD-2024-38933

Malicious code in bioql PyPI...

EUVD-2024-38938

Malicious code in bioql PyPI...

EUVD-2022-0282

Malicious code in bioql PyPI...

EUVD-2024-38932

Malicious code in bioql PyPI...

EUVD-2024-38939

Malicious code in bioql PyPI...

EUVD-2024-38935

Malicious code in bioql PyPI...

EUVD-2024-38931

Malicious code in bioql PyPI...

EUVD-2024-38937

Malicious code in bioql PyPI...

Cross-site Scripting (XSS)

Overview streamlit-shortcuts is a Streamlit keyboard shortcuts for your buttons. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addshortcuts function which fails to properly escape special characters when injecting JavaScript code into the DOM. Details...