{"vulnerability": "cve-2024-3920", "sightings": [{"uuid": "4fe7cbc9-d9ac-46b8-bd83-34baab7c8953", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "https://packetstormsecurity.com/files/182692/pyload_js2py_cve_2024_39205.rb.txt", "content": "", "creation_timestamp": "2024-11-18T14:11:17.000000Z"}, {"uuid": "7f6996e0-1ee8-47bc-93f5-c508a3e0bd87", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:46.000000Z"}, {"uuid": "2555b1b7-aab5-4464-b04d-bfb3f1be496b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:11:03.000000Z"}, {"uuid": "46e84e71-ffee-4847-b1e7-fac0621b7e1d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:03.000000Z"}, {"uuid": "634d7de9-fc69-454d-8b3a-0bda35ec573b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb", "content": "", "creation_timestamp": "2024-11-15T14:30:41.000000Z"}, {"uuid": "c4c1696d-b2b4-4c31-ae5f-73a749a41df2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "Telegram/L38WC5Z6StDAbVGWur3J1et47qVqp8n45yINKLUpuArTxNY", "content": "", "creation_timestamp": "2025-12-23T15:00:07.000000Z"}, {"uuid": "583d286b-4e46-4b60-ad4d-34cd80f20f0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/8488", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPyload Remote RCE via js2py sandbox escape\nURL\uff1ahttps://github.com/Marven11/CVE-2024-39205-Pyload-Remote-RCE\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-09-09T02:35:15.000000Z"}, {"uuid": "5af755f9-f599-480b-9157-af9a0f0bbaab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/8843", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aPyload RCE with js2py sandbox escape \nURL\uff1ahttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-10-26T01:04:05.000000Z"}, {"uuid": "aaec14f8-8b32-484e-a046-1924c01b7214", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "https://t.me/cvedetector/9181", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39205 - Vulnerability Title: Pyload-ng Remote Code Execution\", \n  \"Content\": \"CVE ID : CVE-2024-39205 \nPublished : Oct. 28, 2024, 8:15 p.m. | 42\u00a0minutes ago \nDescription : An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"28 Oct 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-10-28T22:01:38.000000Z"}, {"uuid": "a6abc059-21e3-4027-b1f5-1f61ec139d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39202", "type": "seen", "source": "https://t.me/HackingInsights/5853", "content": "\u200aCVE-2024-39202: RCE Flaw Found in D-Link DIR-823X Firmware, Patch in Development\n\nhttps://securityonline.info/cve-2024-39202-rce-flaw-found-in-d-link-dir-823x-firmware-patch-in-development/", "creation_timestamp": "2024-07-12T13:28:26.000000Z"}, {"uuid": "81609542-fb75-4d94-986b-af97505aaa2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39202", "type": "seen", "source": "https://t.me/cvedetector/191", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39202 - D-Link DIR-823X firmware - 240126 was discovered t\", \n  \"Content\": \"CVE ID : CVE-2024-39202 \nPublished : July 8, 2024, 4:15 p.m. | 23\u00a0minutes ago \nDescription : D-Link DIR-823X firmware - 240126 was discovered to contain a remote command execution (RCE) vulnerability via the dhcpd_startip parameter at /goform/set_lan_settings. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T18:40:37.000000Z"}, {"uuid": "c645ff2f-5978-40d0-9972-1915551d82a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39203", "type": "seen", "source": "https://t.me/cvedetector/188", "content": "{\n  \"Source\": \"CVE FEED\",\n  \"Title\": \"CVE-2024-39203 - A cross-site scripting (XSS) vulnerability in the\", \n  \"Content\": \"CVE ID : CVE-2024-39203 \nPublished : July 8, 2024, 4:15 p.m. | 23\u00a0minutes ago \nDescription : A cross-site scripting (XSS) vulnerability in the Backend Theme Management module of Z-BlogPHP v1.7.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. \nSeverity: 0.0 | NA \nVisit the link for more details, such as CVSS details, affected products, timeline, and more...\",\n  \"Detection Date\": \"08 Jul 2024\",\n  \"Type\": \"Vulnerability\"\n}\n\ud83d\udd39 t.me/cvedetector \ud83d\udd39", "creation_timestamp": "2024-07-08T18:40:31.000000Z"}, {"uuid": "8df4398d-00ad-4d12-bc76-aa5201a19fee", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/CyberDilara/1225", "content": "Tools - Hackers Factory \n\nDetect It Easy, or abbreviated \"DIE\" is a program for determining types of files.\n\nhttps://github.com/horsicq/Detect-It-Easy\n\n#Exploit\n\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512\n\nSemi-automatic OSINT framework and package manager\n\nhttps://github.com/kpcyrd/sn0int\n\nAn Instagram tracker that logs any changes to an Instagram account (followers, following, posts, and bio)\n\nhttps://github.com/ibnaleem/instatracker\n\n#HackersFactory", "creation_timestamp": "2024-11-21T08:10:56.000000Z"}, {"uuid": "c3a58f17-4123-45ea-8038-4ed145e30195", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39202", "type": "published-proof-of-concept", "source": "Telegram/K_Pf3yt50biVhLbNcppXdibjL8IjcyOxDHDbsyvJ7P-36WI", "content": "", "creation_timestamp": "2024-08-10T05:47:38.000000Z"}, {"uuid": "1fb7dd00-cf3e-4184-a716-7a0401720950", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/softrinx/154237", "content": "CVE-2024-39205\n*\nPyload (\u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Python3.11 \u0438\u043b\u0438 \u043d\u0438\u0436\u0435) \u0443\u044f\u0437\u0432\u0438\u043c \u043a RCE\n*\nExploit", "creation_timestamp": "2024-11-01T11:56:41.000000Z"}, {"uuid": "111a11b3-75fa-438b-b71e-af3cb3231239", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/GrayHatsHack/9041", "content": "Tools - Hackers Factory \n\nDetect It Easy, or abbreviated \"DIE\" is a program for determining types of files.\n\nhttps://github.com/horsicq/Detect-It-Easy\n\n#Exploit\n\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512\n\nSemi-automatic OSINT framework and package manager\n\nhttps://github.com/kpcyrd/sn0int\n\nAn Instagram tracker that logs any changes to an Instagram account (followers, following, posts, and bio)\n\nhttps://github.com/ibnaleem/instatracker\n\n#HackersFactory", "creation_timestamp": "2024-11-21T07:58:58.000000Z"}, {"uuid": "972a55e8-a5e9-4b55-a5a9-bd6fef4631da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/InfoSecInsider/24794", "content": "Tools - Hackers Factory \n\nDetect It Easy, or abbreviated \"DIE\" is a program for determining types of files.\n\nhttps://github.com/horsicq/Detect-It-Easy\n\n#Exploit\n\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512\n\nSemi-automatic OSINT framework and package manager\n\nhttps://github.com/kpcyrd/sn0int\n\nAn Instagram tracker that logs any changes to an Instagram account (followers, following, posts, and bio)\n\nhttps://github.com/ibnaleem/instatracker\n\n#HackersFactory", "creation_timestamp": "2024-11-21T07:59:09.000000Z"}, {"uuid": "998cbe8a-76f2-4ed4-857a-d0cd31d0af8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/dilagrafie/3909", "content": "Tools - Hackers Factory \n\nDetect It Easy, or abbreviated \"DIE\" is a program for determining types of files.\n\nhttps://github.com/horsicq/Detect-It-Easy\n\n#Exploit\n\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512\n\nSemi-automatic OSINT framework and package manager\n\nhttps://github.com/kpcyrd/sn0int\n\nAn Instagram tracker that logs any changes to an Instagram account (followers, following, posts, and bio)\n\nhttps://github.com/ibnaleem/instatracker\n\n#HackersFactory", "creation_timestamp": "2024-11-21T04:19:04.000000Z"}, {"uuid": "c7b69f1a-2a5f-4daf-9c4d-003ca4adc7a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/2354", "content": "CVE-2024-39205\n*\nPyload (\u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Python3.11 \u0438\u043b\u0438 \u043d\u0438\u0436\u0435) \u0443\u044f\u0437\u0432\u0438\u043c \u043a RCE\n*\nExploit", "creation_timestamp": "2024-11-01T05:09:28.000000Z"}, {"uuid": "481167c6-c1ef-4cf7-ba7a-e88bda686cd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/softrinx/607", "content": "CVE-2024-39205\n*\nPyload (\u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0439 \u043f\u043e\u0434 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435\u043c Python3.11 \u0438\u043b\u0438 \u043d\u0438\u0436\u0435) \u0443\u044f\u0437\u0432\u0438\u043c \u043a RCE\n*\nExploit", "creation_timestamp": "2024-11-01T11:56:41.000000Z"}, {"uuid": "6f7bfa98-8a5a-43d4-8e3e-3414e3388b09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39202", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/2160", "content": "CVE-2024-39202 D-Link DIR-823X\n*\nRCE\n*\nwriteup\n*\nPOC exploit", "creation_timestamp": "2024-07-12T07:31:55.000000Z"}, {"uuid": "eae763e4-ee33-416a-bea0-28450dddd669", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/GrayHatsHack/7649", "content": "Tools - Hackers Factory \n\nDetect It Easy, or abbreviated \"DIE\" is a program for determining types of files.\n\nhttps://github.com/horsicq/Detect-It-Easy\n\n#Exploit\n\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512\n\nSemi-automatic OSINT framework and package manager\n\nhttps://github.com/kpcyrd/sn0int\n\nAn Instagram tracker that logs any changes to an Instagram account (followers, following, posts, and bio)\n\nhttps://github.com/ibnaleem/instatracker\n\n#HackersFactory", "creation_timestamp": "2024-11-21T07:58:58.000000Z"}, {"uuid": "1a5fa2ae-f7f1-42e1-abc2-d9335c8e8e7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/CNArsenal/3366", "content": "https://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\nRemote code execution by download to /.pyload/scripts using /flashgot API CVE-2024-39205\n\n#github #poc #exploit", "creation_timestamp": "2024-10-27T12:18:42.000000Z"}, {"uuid": "2ddcc11b-7db8-4920-bb70-d43fdc6b99fc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/11344", "content": "#exploit\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512", "creation_timestamp": "2024-10-28T13:32:54.000000Z"}, {"uuid": "2e0cbac1-d2f8-409f-8b6d-aed2ffe40f4a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/InfoSecInsider/739", "content": "Tools - Hackers Factory \n\nDetect It Easy, or abbreviated \"DIE\" is a program for determining types of files.\n\nhttps://github.com/horsicq/Detect-It-Easy\n\n#Exploit\n\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512\n\nSemi-automatic OSINT framework and package manager\n\nhttps://github.com/kpcyrd/sn0int\n\nAn Instagram tracker that logs any changes to an Instagram account (followers, following, posts, and bio)\n\nhttps://github.com/ibnaleem/instatracker\n\n#HackersFactory", "creation_timestamp": "2024-11-21T07:59:09.000000Z"}, {"uuid": "0a018848-5363-439f-86b2-59befd523742", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "published-proof-of-concept", "source": "https://t.me/Rootsec_2/4876", "content": "#exploit\n1. CVE-2024-39205:\nPyload RCE with js2py sandbox escape\nhttps://github.com/Marven11/CVE-2024-39205-Pyload-RCE\n\n2. CVE-2024-40431,\nCVE-2022-25477 - 25480:\nVulnerabilities in RtsPer.sys (Realtek SD Card Reader Driver)\nhttps://github.com/zwclose/realteksd\n\n3. CVE-2024-1512:\nSQLI in MasterStudy LMS WP Plugin\nhttps://github.com/rat-c/CVE-2024-1512", "creation_timestamp": "2024-10-27T16:49:25.000000Z"}, {"uuid": "18a98367-07f1-4e40-aea5-2f3726415b37", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-39205", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb", "content": "{\"aliases\": [], \"arch\": \"cmd, x86, x64\", \"author\": [\"Marven11\", \"Spencer McIntyre\", \"jheysel-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"CVE-2024-28397 is sandbox escape in js2py (<=0.74) which is a popular python package that can evaluate\\n          javascript code inside a python interpreter. The vulnerability allows for an attacker to obtain a reference\\n          to a python object in the js2py environment enabling them to escape the sandbox, bypass pyimport restrictions\\n          and execute arbitrary commands on the host. At the time of writing no patch has been released, version 0.74\\n          is the latest version of js2py which was released Nov 6, 2022.\\n\\n          CVE-2024-39205 is an remote code execution vulnerability in Pyload (<=0.5.0b3.dev85) which is an open-source\\n          download manager designed to automate file downloads from various online sources. Pyload is vulnerable because\\n          it exposes the vulnerable js2py functionality mentioned above on the /flash/addcrypted2 API endpoint.\\n          This endpoint was designed to only accept connections from localhost but by manipulating the HOST header we\\n          can bypass this restriction in order to access the API to achieve unauth RCE.\", \"disclosure_date\": \"2024-10-28\", \"fullname\": \"exploit/linux/http/pyload_js2py_cve_2024_39205\", \"is_install_path\": true, \"mod_time\": \"2026-06-03 06:46:27 +0000\", \"name\": \"Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397)\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\", \"artifacts-on-disk\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/pyload_js2py_cve_2024_39205.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/pyload_js2py_cve_2024_39205\", \"references\": [\"CVE-2024-39205\", \"CVE-2024-28397\", \"EDB-52532\", \"URL-https://github.com/Marven11/CVE-2024-39205-Pyload-RCE\", \"GHSA-w7hq-f2pj-c53g\", \"URL-https://github.com/Marven11/CVE-2024-28397-js2py-Sandbox-Escape\"], \"rport\": 9666, \"session_types\": false, \"targets\": [\"Unix Command\", \"Linux Dropper\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:53.192347Z"}]}