Skip to content
OpenAdvisories

Product · piccolo-orm

piccolo_admin

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 8.8
    CVE-2026-55485

    Piccolo Admin: Privilege escalation - admin to superuser via session-token disclosure in GET /api/tables/sessions/.

    Piccolo Admin is an admin interface and content management system for Python, built on top of Piccolo. Prior to 1.14.0, piccolo_admin/endpoints.py uses superuser_validators to block PUT, PATCH, DELETE, and POST requests by non-superusers but permits GET reque…

    piccolo-orm piccolo_admin piccolo-admin PyPI
  • High 7.7
    CVE-2024-30248

    Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

    Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded c…

    piccolo-orm piccolo_admin piccolo-admin PyPI