Web2py Reflected XSS vulnerability

MEDIO 4.8CVE-2016-4807 · GHSA-pvcp-73cg-6f77 · PYSEC-2026-1063 · Published 11/01/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
web2py PyPI	`≤ 2.14.5`	No fix yet
web2py web2py	`≤ 2.14.5`	No fix yet

Description

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).

NVD description

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).

References

nvd.nist.gov/vuln/detail/CVE-2016-4807 · ADVISORY
web2py/web2py · PACKAGE
exploit-db.com/exploits/39821 · WEB
packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html · WEB
exploit-db.com/exploits/39821 · Exploit
pypi.org/project/web2py · PACKAGE
GitHub Advisory GHSA-pvcp-73cg-6f77 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free