marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-17 12:09:27 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
43ef254134ff983040887285eec6b2023e542a00
Open_Ultra_SAST/benchmarks/pairs/vibe-py/training/manifest.jsonl
T
Marius CiepluchandClaude Fable 5.1 b1c5f36076 feat(pair-corpus-honesty): review tiers on every pair, agent-vfc loads at tier title 
Tasks 8.1, 7.1 (tests) and the re-scoped 5.3.

- pairs.py: review_tier in {seeded, advisory, title, reviewed} with
  per-slice defaults (local reviewed, vibe-py seeded, sast/vfc/vfc-js/
  github advisory, agent-vfc title); reviewer = "pending" means title, a
  named reviewer means reviewed, reviewed without a reviewer is rejected;
  per_tier metrics in the payload; select_tier and GATING_TIERS for the
  improve loop.
- catalog_gen.py: stamps review_tier (and reviewer) on every generated
  row and training manifest row; title rows enter catalog.toml; the
  catalog-candidates.toml queue is retired; precedence matches the loader.
- agent-vfc: 29 title-tier rows load and score (0/29, Youden 0.0, the
  honest unreviewed baseline); local rows name their reviewer.
- Tests: tier defaults, loader rejections, per_tier payload, the Req 8.1
  catalog-on-disk / stage-1 exclusion proof and per-slice CLI checks.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
Claude-Session: https://claude.ai/code/session_01T7XD7x5KonMdmGRkp63EQG
2026-09-05 10:45:43 +02:00

71 lines
46 KiB
JSON
Raw Blame History

{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-mutate/vuln.py", "function": "mutate", "id": "damn-vulnerable-graphql-application-views-mutate:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-mutate", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L211", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-mutate/fixed.py", "function": "mutate", "id": "damn-vulnerable-graphql-application-views-mutate:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-mutate", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", "cve": "", "cwe": "CWE-89", "file": "damn-vulnerable-graphql-application-views-resolve-pastes/vuln.py", "function": "resolve_pastes", "id": "damn-vulnerable-graphql-application-views-resolve-pastes:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-pastes", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L320", "cve": "", "cwe": "CWE-89", "file": "damn-vulnerable-graphql-application-views-resolve-pastes/fixed.py", "function": "resolve_pastes", "id": "damn-vulnerable-graphql-application-views-resolve-pastes:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-pastes", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-resolve-system-dia/vuln.py", "function": "resolve_system_diagnostics", "id": "damn-vulnerable-graphql-application-views-resolve-system-dia:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "command_injection", "commit": "a961308c02d1fb462b192681c336b0739e432da7", "commit_url": "https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/blob/a961308c02d1fb462b192681c336b0739e432da7/core/views.py#L345", "cve": "", "cwe": "CWE-78", "file": "damn-vulnerable-graphql-application-views-resolve-system-dia/fixed.py", "function": "resolve_system_diagnostics", "id": "damn-vulnerable-graphql-application-views-resolve-system-dia:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "damn-vulnerable-graphql-application-views-resolve-system-dia", "project": "realvuln-damn-vulnerable-graphql-application", "provenance": "human", "relpath": "core/views.py", "repo": "dolevf/Damn-Vulnerable-GraphQL-Application", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", "cve": "", "cwe": "CWE-89", "file": "djangoat-analytics-hits-by-ip/vuln.py", "function": "hits_by_ip", "id": "djangoat-analytics-hits-by-ip:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-analytics-hits-by-ip", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/models/Analytics/analytics.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/models/Analytics/analytics.py#L57", "cve": "", "cwe": "CWE-89", "file": "djangoat-analytics-hits-by-ip/fixed.py", "function": "hits_by_ip", "id": "djangoat-analytics-hits-by-ip:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-analytics-hits-by-ip", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/models/Analytics/analytics.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "insecure_deserialization", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", "cve": "", "cwe": "CWE-502", "file": "djangoat-views-reset-password/vuln.py", "function": "reset_password", "id": "djangoat-views-reset-password:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-reset-password", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/password_resets/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "insecure_deserialization", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/password_resets/views.py#L84", "cve": "", "cwe": "CWE-502", "file": "djangoat-views-reset-password/fixed.py", "function": "reset_password", "id": "djangoat-views-reset-password:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-reset-password", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/password_resets/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", "cve": "", "cwe": "CWE-89", "file": "djangoat-views-user-view/vuln.py", "function": "user_view", "id": "djangoat-views-user-view:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-user-view", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/users/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "082c88bfefced508ae083b92b459c808f95e905e", "commit_url": "https://github.com/Contrast-Security-OSS/DjanGoat/blob/082c88bfefced508ae083b92b459c808f95e905e/app/views/users/views.py#L74", "cve": "", "cwe": "CWE-89", "file": "djangoat-views-user-view/fixed.py", "function": "user_view", "id": "djangoat-views-user-view:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "djangoat-views-user-view", "project": "realvuln-djangoat", "provenance": "human", "relpath": "app/views/users/views.py", "repo": "Contrast-Security-OSS/DjanGoat", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", "cve": "", "cwe": "CWE-89", "file": "dsvpwa-attacks-run/vuln.py", "function": "run", "id": "dsvpwa-attacks-run:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-attacks-run", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/attacks.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/attacks.py#L39", "cve": "", "cwe": "CWE-89", "file": "dsvpwa-attacks-run/fixed.py", "function": "run", "id": "dsvpwa-attacks-run:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-attacks-run", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/attacks.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "security_misconfiguration", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", "cve": "", "cwe": "CWE-326", "file": "dsvpwa-dsvpwa-main/vuln.py", "function": "main", "id": "dsvpwa-dsvpwa-main:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dsvpwa-dsvpwa-main", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "security_misconfiguration", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa.py#L37", "cve": "", "cwe": "CWE-326", "file": "dsvpwa-dsvpwa-main/fixed.py", "function": "main", "id": "dsvpwa-dsvpwa-main:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dsvpwa-dsvpwa-main", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "command_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", "cve": "", "cwe": "CWE-78", "file": "dsvpwa-handlers-do-bdr/vuln.py", "function": "do_BDR", "id": "dsvpwa-handlers-do-bdr:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-handlers-do-bdr", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/handlers.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "command_injection", "commit": "a06abb306ed3699bb2f073e3f41d3d9c57012819", "commit_url": "https://github.com/sgabe/DSVPWA/blob/a06abb306ed3699bb2f073e3f41d3d9c57012819/dsvpwa/handlers.py#L183", "cve": "", "cwe": "CWE-78", "file": "dsvpwa-handlers-do-bdr/fixed.py", "function": "do_BDR", "id": "dsvpwa-handlers-do-bdr:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dsvpwa-handlers-do-bdr", "project": "realvuln-dsvpwa", "provenance": "human", "relpath": "dsvpwa/handlers.py", "repo": "sgabe/DSVPWA", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "7d40f4b7939c901610ed9b85724552d60e7d63fa", "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", "cve": "", "cwe": "CWE-89", "file": "dsvw-dsvw-do-get/vuln.py", "function": "do_GET", "id": "dsvw-dsvw-do-get:vuln", "label": "vuln", "license": "Unlicense", "mechanism": "source_reaches_sink", "pair": "dsvw-dsvw-do-get", "project": "realvuln-dsvw", "provenance": "human", "relpath": "dsvw.py", "repo": "stamparm/DSVW", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "7d40f4b7939c901610ed9b85724552d60e7d63fa", "commit_url": "https://github.com/stamparm/DSVW/blob/7d40f4b7939c901610ed9b85724552d60e7d63fa/dsvw.py#L30", "cve": "", "cwe": "CWE-89", "file": "dsvw-dsvw-do-get/fixed.py", "function": "do_GET", "id": "dsvw-dsvw-do-get:fixed", "label": "fixed", "license": "Unlicense", "mechanism": "source_reaches_sink", "pair": "dsvw-dsvw-do-get", "project": "realvuln-dsvw", "provenance": "human", "relpath": "dsvw.py", "repo": "stamparm/DSVW", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", "cve": "", "cwe": "CWE-16", "file": "dvpwa-app-init/vuln.py", "function": "init", "id": "dvpwa-app-init:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-app-init", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/app.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/app.py#L35", "cve": "", "cwe": "CWE-16", "file": "dvpwa-app-init/fixed.py", "function": "init", "id": "dvpwa-app-init:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-app-init", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/app.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", "cve": "", "cwe": "CWE-1004", "file": "dvpwa-middlewares-session-middleware/vuln.py", "function": "session_middleware", "id": "dvpwa-middlewares-session-middleware:vuln", "label": "vuln", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-middlewares-session-middleware", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/middlewares.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "security_misconfiguration", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/middlewares.py#L20", "cve": "", "cwe": "CWE-1004", "file": "dvpwa-middlewares-session-middleware/fixed.py", "function": "session_middleware", "id": "dvpwa-middlewares-session-middleware:fixed", "label": "fixed", "license": "MIT", "mechanism": "permissive_default", "pair": "dvpwa-middlewares-session-middleware", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/middlewares.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", "cve": "", "cwe": "CWE-89", "file": "dvpwa-student-create/vuln.py", "function": "create", "id": "dvpwa-student-create:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dvpwa-student-create", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/dao/student.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "a1d8f89fac2e57093189853c6527c2b01fc1d9c1", "commit_url": "https://github.com/anxolerd/dvpwa/blob/a1d8f89fac2e57093189853c6527c2b01fc1d9c1/sqli/dao/student.py#L42", "cve": "", "cwe": "CWE-89", "file": "dvpwa-student-create/fixed.py", "function": "create", "id": "dvpwa-student-create:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "dvpwa-student-create", "project": "realvuln-dvpwa", "provenance": "human", "relpath": "sqli/dao/student.py", "repo": "anxolerd/dvpwa", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "insecure_deserialization", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", "cve": "", "cwe": "CWE-502", "file": "extremely-vulnerable-flask-app-account-before-request/vuln.py", "function": "before_request", "id": "extremely-vulnerable-flask-app-account-before-request:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-before-request", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "insecure_deserialization", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L118", "cve": "", "cwe": "CWE-502", "file": "extremely-vulnerable-flask-app-account-before-request/fixed.py", "function": "before_request", "id": "extremely-vulnerable-flask-app-account-before-request:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-before-request", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-account-search/vuln.py", "function": "search", "id": "extremely-vulnerable-flask-app-account-search:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-search", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/account.py#L33", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-account-search/fixed.py", "function": "search", "id": "extremely-vulnerable-flask-app-account-search:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-account-search", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/account.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-signup-validate-token/vuln.py", "function": "validate_token", "id": "extremely-vulnerable-flask-app-signup-validate-token:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-signup-validate-token", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/signup.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "d5d8875559e21222bbbaadb7b9f0af592c6eb7fa", "commit_url": "https://github.com/manuelz120/extremely-vulnerable-flask-app/blob/d5d8875559e21222bbbaadb7b9f0af592c6eb7fa/routes/signup.py#L15", "cve": "", "cwe": "CWE-89", "file": "extremely-vulnerable-flask-app-signup-validate-token/fixed.py", "function": "validate_token", "id": "extremely-vulnerable-flask-app-signup-validate-token:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "extremely-vulnerable-flask-app-signup-validate-token", "project": "realvuln-extremely-vulnerable-flask-app", "provenance": "human", "relpath": "routes/signup.py", "repo": "manuelz120/extremely-vulnerable-flask-app", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "ssti", "commit": "80b894a2f754590747a31c92b2088be086421953", "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", "cve": "", "cwe": "CWE-1336", "file": "python-insecure-app-main-try-hack-me/vuln.py", "function": "try_hack_me", "id": "python-insecure-app-main-try-hack-me:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "python-insecure-app-main-try-hack-me", "project": "realvuln-python-insecure-app", "provenance": "human", "relpath": "app/main.py", "repo": "kolega-ai/realvuln-python-insecure-app", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "ssti", "commit": "80b894a2f754590747a31c92b2088be086421953", "commit_url": "https://github.com/kolega-ai/realvuln-python-insecure-app/blob/80b894a2f754590747a31c92b2088be086421953/app/main.py#L41", "cve": "", "cwe": "CWE-1336", "file": "python-insecure-app-main-try-hack-me/fixed.py", "function": "try_hack_me", "id": "python-insecure-app-main-try-hack-me:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "python-insecure-app-main-try-hack-me", "project": "realvuln-python-insecure-app", "provenance": "human", "relpath": "app/main.py", "repo": "kolega-ai/realvuln-python-insecure-app", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "reflected_xss", "commit": "76339c27d5a870c0a81bad6aee5f9bd516592145", "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", "cve": "", "cwe": "CWE-79", "file": "pythonssti-main-read-root/vuln.py", "function": "read_root", "id": "pythonssti-main-read-root:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pythonssti-main-read-root", "project": "realvuln-pythonssti", "provenance": "human", "relpath": "main.py", "repo": "TheWation/PythonSSTI", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "reflected_xss", "commit": "76339c27d5a870c0a81bad6aee5f9bd516592145", "commit_url": "https://github.com/TheWation/PythonSSTI/blob/76339c27d5a870c0a81bad6aee5f9bd516592145/main.py#L14", "cve": "", "cwe": "CWE-79", "file": "pythonssti-main-read-root/fixed.py", "function": "read_root", "id": "pythonssti-main-read-root:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "pythonssti-main-read-root", "project": "realvuln-pythonssti", "provenance": "human", "relpath": "main.py", "repo": "TheWation/PythonSSTI", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", "cve": "", "cwe": "CWE-862", "file": "threatbyte-api-v1-delete/vuln.py", "function": "delete", "id": "threatbyte-api-v1-delete:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-delete", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L223", "cve": "", "cwe": "CWE-862", "file": "threatbyte-api-v1-delete/fixed.py", "function": "delete", "id": "threatbyte-api-v1-delete:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-delete", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", "cve": "", "cwe": "CWE-639", "file": "threatbyte-api-v1-get/vuln.py", "function": "get", "id": "threatbyte-api-v1-get:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-get", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "broken_access_control", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/api/v1/api_v1.py#L154", "cve": "", "cwe": "CWE-639", "file": "threatbyte-api-v1-get/fixed.py", "function": "get", "id": "threatbyte-api-v1-get:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "threatbyte-api-v1-get", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/api/v1/api_v1.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", "cve": "", "cwe": "CWE-89", "file": "threatbyte-routes-dashboard/vuln.py", "function": "dashboard", "id": "threatbyte-routes-dashboard:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "threatbyte-routes-dashboard", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/routes.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "c4db46f72586c4ecb65859051ea037018dbf0e5e", "commit_url": "https://github.com/anotherik/ThreatByte/blob/c4db46f72586c4ecb65859051ea037018dbf0e5e/server/routes.py#L137", "cve": "", "cwe": "CWE-89", "file": "threatbyte-routes-dashboard/fixed.py", "function": "dashboard", "id": "threatbyte-routes-dashboard:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "threatbyte-routes-dashboard", "project": "realvuln-threatbyte", "provenance": "human", "relpath": "server/routes.py", "repo": "anotherik/ThreatByte", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", "cve": "", "cwe": "CWE-639", "file": "vampi-books-get-by-title/vuln.py", "function": "get_by_title", "id": "vampi-books-get-by-title:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-books-get-by-title", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/books.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/books.py#L51", "cve": "", "cwe": "CWE-639", "file": "vampi-books-get-by-title/fixed.py", "function": "get_by_title", "id": "vampi-books-get-by-title:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-books-get-by-title", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/books.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", "cve": "", "cwe": "CWE-89", "file": "vampi-user-model-get-user/vuln.py", "function": "get_user", "id": "vampi-user-model-get-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vampi-user-model-get-user", "project": "realvuln-vampi", "provenance": "human", "relpath": "models/user_model.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/models/user_model.py#L72", "cve": "", "cwe": "CWE-89", "file": "vampi-user-model-get-user/fixed.py", "function": "get_user", "id": "vampi-user-model-get-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vampi-user-model-get-user", "project": "realvuln-vampi", "provenance": "human", "relpath": "models/user_model.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", "cve": "", "cwe": "CWE-639", "file": "vampi-users-update-password/vuln.py", "function": "update_password", "id": "vampi-users-update-password:vuln", "label": "vuln", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-users-update-password", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/users.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "broken_access_control", "commit": "1713b54b601ad29582581eeda4b31fceb1319874", "commit_url": "https://github.com/erev0s/VAmPI/blob/1713b54b601ad29582581eeda4b31fceb1319874/api_views/users.py#L187", "cve": "", "cwe": "CWE-639", "file": "vampi-users-update-password/fixed.py", "function": "update_password", "id": "vampi-users-update-password:fixed", "label": "fixed", "license": "MIT", "mechanism": "missing_auth_guard", "pair": "vampi-users-update-password", "project": "realvuln-vampi", "provenance": "human", "relpath": "api_views/users.py", "repo": "erev0s/VAmPI", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-delete-user/vuln.py", "function": "delete_user", "id": "vfapi-main-delete-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-delete-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L231", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-delete-user/fixed.py", "function": "delete_user", "id": "vfapi-main-delete-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-delete-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-put-user/vuln.py", "function": "put_user", "id": "vfapi-main-put-user:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-put-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L188", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-put-user/fixed.py", "function": "put_user", "id": "vfapi-main-put-user:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-put-user", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-sql-return-users-from-username/vuln.py", "function": "sql_return_users_from_username", "id": "vfapi-main-sql-return-users-from-username:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-sql-return-users-from-username", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3", "commit_url": "https://github.com/naryal2580/vfapi/blob/f36f177e1a32aa49272f4eb52f8be0af3e8f6bc3/main.py#L182", "cve": "", "cwe": "CWE-89", "file": "vfapi-main-sql-return-users-from-username/fixed.py", "function": "sql_return_users_from_username", "id": "vfapi-main-sql-return-users-from-username:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vfapi-main-sql-return-users-from-username", "project": "realvuln-vfapi", "provenance": "human", "relpath": "main.py", "repo": "naryal2580/vfapi", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "reflected_xss", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", "cve": "", "cwe": "CWE-79", "file": "vulnerable-python-apps-bad-mvc-do-get/vuln.py", "function": "do_GET", "id": "vulnerable-python-apps-bad-mvc-do-get:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "vulnerable-python-apps-bad-mvc-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Insecure_Frameworks/bad_mvc.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "reflected_xss", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Insecure_Frameworks/bad_mvc.py#L37", "cve": "", "cwe": "CWE-79", "file": "vulnerable-python-apps-bad-mvc-do-get/fixed.py", "function": "do_GET", "id": "vulnerable-python-apps-bad-mvc-do-get:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "source_reaches_sink", "pair": "vulnerable-python-apps-bad-mvc-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Insecure_Frameworks/bad_mvc.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "path_traversal", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", "cve": "", "cwe": "CWE-22", "file": "vulnerable-python-apps-dir-traversal-do-get/vuln.py", "function": "do_GET", "id": "vulnerable-python-apps-dir-traversal-do-get:vuln", "label": "vuln", "license": "GPL-3.0", "mechanism": "path_join_user_input", "pair": "vulnerable-python-apps-dir-traversal-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Directory_Traversal/Dir_Traversal.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "path_traversal", "commit": "6336c77e6db523a5df34c4b628dff4159110797a", "commit_url": "https://github.com/LinuxUser255/Vulnerable_Python_Apps/blob/6336c77e6db523a5df34c4b628dff4159110797a/Directory_Traversal/Dir_Traversal.py#L22", "cve": "", "cwe": "CWE-22", "file": "vulnerable-python-apps-dir-traversal-do-get/fixed.py", "function": "do_GET", "id": "vulnerable-python-apps-dir-traversal-do-get:fixed", "label": "fixed", "license": "GPL-3.0", "mechanism": "path_join_user_input", "pair": "vulnerable-python-apps-dir-traversal-do-get", "project": "realvuln-vulnerable-python-apps", "provenance": "human", "relpath": "Directory_Traversal/Dir_Traversal.py", "repo": "LinuxUser255/Vulnerable_Python_Apps", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-os-system/vuln.py", "function": "do_os_system", "id": "vulnpy-cmdi-do-os-system:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-os-system", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L6", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-os-system/fixed.py", "function": "do_os_system", "id": "vulnpy-cmdi-do-os-system:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-os-system", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-subprocess-popen/vuln.py", "function": "do_subprocess_popen", "id": "vulnpy-cmdi-do-subprocess-popen:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-subprocess-popen", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "command_injection", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/cmdi.py#L10", "cve": "", "cwe": "CWE-78", "file": "vulnpy-cmdi-do-subprocess-popen/fixed.py", "function": "do_subprocess_popen", "id": "vulnpy-cmdi-do-subprocess-popen:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-cmdi-do-subprocess-popen", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/cmdi.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "insecure_deserialization", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", "cve": "", "cwe": "CWE-502", "file": "vulnpy-deserialization-do-pickle-load/vuln.py", "function": "do_pickle_load", "id": "vulnpy-deserialization-do-pickle-load:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-deserialization-do-pickle-load", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/deserialization.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "insecure_deserialization", "commit": "d1d0f64c06f038fe59a049e0e6001bfaf9839697", "commit_url": "https://github.com/Contrast-Security-OSS/vulnpy/blob/d1d0f64c06f038fe59a049e0e6001bfaf9839697/src/vulnpy/trigger/deserialization.py#L8", "cve": "", "cwe": "CWE-502", "file": "vulnpy-deserialization-do-pickle-load/fixed.py", "function": "do_pickle_load", "id": "vulnpy-deserialization-do-pickle-load:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulnpy-deserialization-do-pickle-load", "project": "realvuln-vulnpy", "provenance": "human", "relpath": "src/vulnpy/trigger/deserialization.py", "repo": "Contrast-Security-OSS/vulnpy", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-create/vuln.py", "function": "create", "id": "vulpy-libuser-create:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-create", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L25", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-create/fixed.py", "function": "create", "id": "vulpy-libuser-create:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-create", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-login/vuln.py", "function": "login", "id": "vulpy-libuser-login:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-login", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L12", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-login/fixed.py", "function": "login", "id": "vulpy-libuser-login:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-login", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "train", "year": 2026}
{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-password-change/vuln.py", "function": "password_change", "id": "vulpy-libuser-password-change:vuln", "label": "vuln", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-password-change", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026}
{"class": "sql_injection", "commit": "5249cc8b05a1c37f6b2f757b1cf16a509c327122", "commit_url": "https://github.com/fportantier/vulpy/blob/5249cc8b05a1c37f6b2f757b1cf16a509c327122/bad/libuser.py#L53", "cve": "", "cwe": "CWE-89", "file": "vulpy-libuser-password-change/fixed.py", "function": "password_change", "id": "vulpy-libuser-password-change:fixed", "label": "fixed", "license": "MIT", "mechanism": "source_reaches_sink", "pair": "vulpy-libuser-password-change", "project": "realvuln-vulpy", "provenance": "human", "relpath": "bad/libuser.py", "repo": "fportantier/vulpy", "review_tier": "seeded", "split": "holdout", "year": 2026}
Reference in New Issue View Git Blame Copy Permalink