web2py exposure of sensitive information

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-3954 · ADVISORY
• web2py/web2py commit 0820926 · WEB
• devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · WEB
• web2py/web2py · PACKAGE
• usn.ubuntu.com/4030-1 · WEB
• devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957 · Exploit
• usn.ubuntu.com/4030-1
• pypi.org/project/web2py · PACKAGE
• GitHub Advisory GHSA-jr83-vr4j-mp6p · ADVISORY

More vulnerabilities in web2py

• CVE-2026-25198MEDIUM 5.1web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is explo…
• CVE-2023-22432MEDIUM 6.1Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary …
• CVE-2022-33146MEDIUM 6.1Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and cond…
• CVE-2016-3953CRITICAL 9.8The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a har…
• CVE-2016-10321CRITICAL 9.8web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-for…