Skip to content
OpenAdvisories

Vendor

mar10

3 known vulnerabilities.

Products

wsgidav 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2026-55509

    WsgiDAV: Blind SQL injection in the MySQL provider

    WsgiDAV is a generic and extendable WebDAV server based on WSGI. Prior to 4.3.5, the sample MySQLBrowserProvider in wsgidav/samples/mysql_dav_provider.py concatenates the record key parsed from a request URL directly into SQL WHERE clauses. The affected _exis…

    mar10 wsgidav wsgidav PyPI
  • High 7.1
    CVE-2026-48099

    WsgiDAV encoded dot segments can escape filesystem share roots

    WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixe…

    mar10 wsgidav wsgidav PyPI
  • High 8.2
    CVE-2022-41905

    wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabled

    WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross Site Scripting (XSS) attacks. This issue has been patched, users can upgrade to version 4.1.0. As a…

    mar10 wsgidav wsgidav PyPI