Skip to content
OpenAdvisories

Package · PyPI

pyload-ng

58 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

58 results · Feed

  • High 8.7
    CVE-2025-7346

    pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages

    Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages

    pyload pyload pyload-ng PyPI
  • Medium 4.6
    CVE-2024-1240

    Open Redirection in pyload/pyload

    An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which c…

    pyload pyload/pyload pyload-ng PyPI
  • Critical 9.8
    CVE-2024-39205 Public exploit EPSS 17%

    pyload-ng vulnerable to RCE with js2py sandbox escape

    An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP request.

    pyload-ng PyPI
  • Critical 9.1
    CVE-2024-47821

    pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API

    pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respect…

    pyload pyload pyload-ng PyPI
  • Critical 9.1
    CVE-2024-32880

    pyLoad allows upload to arbitrary folder lead to RCE

    pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.

    pyload pyload pyload-ng PyPI
  • Medium 4.7
    CVE-2024-24808

    pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

    pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redire…

    pyload pyload pyload-ng PyPI
  • Critical 9.7
    CVE-2024-22416 Public exploit

    Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

    pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities v…

    pyload pyload pyload-ng PyPI
  • High 7.5
    CVE-2024-21644 Public exploit Scanner template EPSS 42%

    pyLoad unauthenticated flask configuration leakage

    pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

    pyload pyload pyload-ng PyPI
  • Medium 5.3
    CVE-2024-21645 Scanner template EPSS 25%

    pyLoad Log Injection

    pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corru…

    pyload pyload pyload-ng PyPI
  • High 8.8
    CVE-2023-47890

    Download to arbitrary folder can lead to RCE

    pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.

    pyload-ng PyPI
  • High 7.4
    CVE-2023-0509

    Improper Certificate Validation in pyload/pyload

    Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

    pyload pyload/pyload pyload-ng PyPI
  • Critical 9.6
    CVE-2023-0488

    Cross-site Scripting (XSS) - Stored in pyload/pyload

    Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.

    pyload pyload/pyload pyload-ng PyPI
  • Medium 5.4
    CVE-2023-0434

    Improper Input Validation in pyload/pyload

    Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.

    pyload pyload/pyload pyload-ng PyPI
  • Medium 4.0
    CVE-2023-0435

    Excessive Attack Surface in pyload/pyload

    Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

    pyload pyload/pyload pyload-ng PyPI
  • Critical 9.8
    CVE-2023-0297 Public exploit Scanner template EPSS 96%

    Code Injection in pyload/pyload

    Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

    pyload pyload/pyload pyload-ng PyPI
  • High 8.3
    CVE-2023-0227

    Insufficient Session Expiration in pyload/pyload

    Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.

    pyload pyload/pyload pyload-ng PyPI
  • Low 3.1
    CVE-2023-0057

    Improper Restriction of Rendered UI Layers or Frames in pyload/pyload

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

    pyload pyload/pyload pyload-ng PyPI
  • Low 3.1
    CVE-2023-0055

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.

    pyload pyload/pyload pyload-ng PyPI