EUVD-2026-19103
GHSA-572h-cr7p-cmh8
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability has been found in Song-Li cross_browser up to ca690f0fe6954fd9bcda36d071b68ed8682a786a. This affects an unknown part of the file flask/uniquemachine_app.py of the component details Endpoint. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
SQL injection in Song-Li cross_browser application allows remote code execution via unsanitized ID parameter in the details endpoint of flask/uniquemachine_app.py. The vulnerability affects all versions up to commit ca690f0fe6954fd9bcda36d071b68ed8682a786a, requires no authentication, and has publicly available exploit code. The vendor has not responded to disclosure attempts, and the product's rolling-release model means no traditional patched version has been released.
Technical ContextAI
The vulnerability exists in a Flask-based web application (cross_browser) written in Python. The flaw is a classic SQL injection (CWE-89) where user-supplied input in the ID parameter of the details endpoint in flask/uniquemachine_app.py is passed directly into SQL queries without proper parameterization or sanitization. This allows an attacker to inject arbitrary SQL commands. The attack surface is a remote HTTP endpoint with no authentication requirement (PR:N in CVSS vector), making it trivially accessible. The underlying issue is the failure to use prepared statements or input validation before constructing dynamic SQL queries.
RemediationAI
Given the vendor's non-responsiveness and rolling-release model, remediation requires direct source code patching. Developers should immediately review and fix the vulnerable code in flask/uniquemachine_app.py by implementing parameterized SQL queries (prepared statements) for the details endpoint ID parameter, ensuring all user input is properly escaped or bound to query placeholders. Organizations unable to patch source code directly should implement a Web Application Firewall (WAF) with SQL injection detection rules to block malicious ID parameters, restrict network access to the affected endpoint via firewall rules or authentication layers, and consider isolating the application until patching is completed. The public exploit at https://github.com/wing3e/public_exp/issues/24 should be reviewed to understand the exact attack vector. Consult VulDB at https://vuldb.com/vuln/355347 for additional technical details and community-contributed mitigations.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today