CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 낮음2.3 |
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions |
| 25/10/2024 |
| CVE-2024-32880 | 높음7.2 | pyload is an open-source Download Manager written in pure Python. An authenticated user can change the download folder and upload a crafted template to the specified folder lead to remote code execution. There is no fix available at the time of publication. | 26/04/2024 |
| CVE-2024-24808 | 보통6.1 | pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login. This vulnerability has been patched wit | 06/02/2024 |
| CVE-2024-22416 | 높음8.8 | pyLoad is a free and open-source Download Manager written in pure Python. The `pyload` API allows any API call to be made using GET requests. Since the session cookie is not set to `SameSite: strict`, this opens the library up to severe attack possibilities via a Cross-Site Request Forgery (CSRF) attack. As a result an | 18/01/2024 |
| CVE-2023-47890 | 높음8.8 | pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. | 08/01/2024 |
| CVE-2024-21645 | 보통5.3 | pyLoad is the free and open-source Download Manager written in pure Python. A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. Forged or otherwise, corrupted log files can be used to cover an attacker’s tracks or e | 08/01/2024 |
| CVE-2024-21644 | 높음7.5 | pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. This issue has been patched in version 0.5.0b3.dev77. | 08/01/2024 |
| CVE-2023-0509 | 높음7.4 | Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44. | 26/01/2023 |
| CVE-2023-0488 | 보통5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42. | 26/01/2023 |
| CVE-2023-0435 | 심각9.8 | Excessive Attack Surface in GitHub repository pyload/pyload prior to 0.5.0b3.dev41. | 22/01/2023 |
| CVE-2023-0434 | 높음7.5 | Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40. | 22/01/2023 |
| CVE-2023-0297 | 심각9.8 | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. | 14/01/2023 |
| CVE-2023-0227 | 보통6.5 | Insufficient Session Expiration in GitHub repository pyload/pyload prior to 0.5.0b3.dev36. | 12/01/2023 |
| CVE-2023-0057 | 보통6.1 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository pyload/pyload prior to 0.5.0b3.dev33. | 05/01/2023 |
| CVE-2023-0055 | 보통5.3 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. | 04/01/2023 |