Code Injection in pyload-ng

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2023-0297 · ADVISORY
• pyload/pyload commit 7d73ba7 · WEB
• huntr.dev/bounties/3fd606f7-83e1-4265-b083-2e1889a05e65 · WEB
• packetstormsecurity.com/files/171096/pyLoad-js2py-Python-Execution.html · WEB
• packetstormsecurity.com/files/172914/PyLoad-0.5.0-Remote-Code-Execution.html · WEB
• pypi.org/project/pyload-ng · PACKAGE
• GitHub Advisory GHSA-pf38-5p22-x6h6 · ADVISORY

pyload-ng のその他の脆弱性

• CVE-2026-75597中 5.3pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/<path:filename>` route in `src/pyloa…
• CVE-2026-48484中 6.5pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` h…
• GHSA-68w4-83fh-f2w8高 8.1pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
• GHSA-9q47-3cm2-2rp8中pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header
• GHSA-jq7h-wrvp-3rgx高 7.5pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session