CVE-2025-3248

POC of CVE-2025-3248

CVE-2025-3248-POC POC of CVE-2025-3248 usage: python pocpy 'xxxcom' 'ls /' leave some love on victims' computers pocpy

A vulnerability scanner for CVE-2025-3248 in Langflow applications.

中文 ｜ English Langflow Vulnerability Scanner A vulnerability scanner for CVE-2025-3248 in Langflow applications Features Scan single target or multiple targets using FOFA Execute system commands on vulnerable targets Retrieve system information Custom payload support Progress bar for FOFA scanning Beautiful CLI interface Installation Clone the repository: git clone ht

POC - Remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code - CVE-2025-3248 Overview Langflow versions prior to 130 are susceptible to code injection in the /api/v1/validate/code endpoint A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code Read about it — CVE-2025-3248 Disclaimer: Th

Pre-Built Vulnerable Environments Based on Docker-Compose

Vulhub is an open-source collection of pre-built, ready-to-use vulnerable Docker environments With just one command you can launch a vulnerable environment for security research, learning, or demonstration, no prior Docker experience required 中文版本(Chinese version) Quick Start Install Docker (example for Ubuntu 2404): # Install the latest version docker curl -s https:

Scanner and exploit for CVE-2025-3248

CVE-2025-3248 Scanner and exploit for CVE-2025-3248

CVE-2025-3248: A critical flaw has been discovered in Langflow that allows malicious actors to execute arbitrary Python code on the target system. This can lead to full remote code execution without authentication, potentially giving attackers control over the server.

CVE-2025-3248 – Execute arbitrary Python code on vulnerable Langflow server Discovered by: Naveen Sunkavally, Horizon3ai Status: Public Disclosure Date Reported: 2025-04-07 CVE ID: CVE-2025-3248 🧾 Screenshot 🧩 Summary A critical flaw has been discovered in Langflow that allows malicious actors to execute arbitrary Python code on the target system This can lead

Langflow validate/code API pre-Auth Remote Code Execution (CVE-2025-3248) 화이트햇 스쿨 3기 - 권석재 @seokjea 요약 Langflow 130 이전 버전의 /api/v1/validate/code API에서는 사용자 입력을 파싱한 뒤 exec 함수로 실행하는 구조를 가지고 있어, Python의 데코레이터 또는 기본 인자 표현식에 악성 코드를 삽입함으로써