Skip to content
OpenAdvisories

Vendor

pyload

53 known vulnerabilities.

Products

pyload 44 pyload/pyload 9
All Critical High Medium Low Exploited only Public exploit

53 results · Feed

  • Critical 9.1
    CVE-2024-32880

    pyLoad allows upload to arbitrary folder lead to RCE

    pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication.

    pyload pyload pyload-ng PyPI
  • Medium 4.7
    CVE-2024-24808

    pyLoad open redirect vulnerability due to improper validation of the is_safe_url function

    pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redire…

    pyload pyload pyload-ng PyPI
  • Critical 9.7
    CVE-2024-22416 Public exploit

    Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation

    pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities v…

    pyload pyload pyload-ng PyPI
  • High 7.5
    CVE-2024-21644 Public exploit EPSS 42%

    pyLoad unauthenticated flask configuration leakage

    pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77.

    pyload pyload pyload-ng PyPI
  • Medium 5.3
    CVE-2024-21645 EPSS 25%

    pyLoad Log Injection

    pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corru…

    pyload pyload pyload-ng PyPI
  • High 7.4
    CVE-2023-0509

    Improper Certificate Validation in pyload/pyload

    Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

    pyload pyload/pyload pyload-ng PyPI
  • Critical 9.6
    CVE-2023-0488

    Cross-site Scripting (XSS) - Stored in pyload/pyload

    Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.

    pyload pyload/pyload pyload-ng PyPI
  • Medium 5.4
    CVE-2023-0434

    Improper Input Validation in pyload/pyload

    Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.

    pyload pyload/pyload pyload-ng PyPI
  • Medium 4.0
    CVE-2023-0435

    Excessive Attack Surface in pyload/pyload

    Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41.

    pyload pyload/pyload pyload-ng PyPI
  • Critical 9.8
    CVE-2023-0297 Public exploit EPSS 96%

    Code Injection in pyload/pyload

    Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31.

    pyload pyload/pyload pyload-ng PyPI
  • High 8.3
    CVE-2023-0227

    Insufficient Session Expiration in pyload/pyload

    Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36.

    pyload pyload/pyload pyload-ng PyPI
  • Low 3.1
    CVE-2023-0057

    Improper Restriction of Rendered UI Layers or Frames in pyload/pyload

    Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33.

    pyload pyload/pyload pyload-ng PyPI
  • Low 3.1
    CVE-2023-0055

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload

    Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.

    pyload pyload/pyload pyload-ng PyPI