Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact

web2py web2py vulnerabilities and exploits

(subscribe to this query)
NA
CVE-2013-2311
Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py prior to 2.3.1 allows remote malicious users to inject arbitrary web script or HTML via unspecified vectors.
Web2py Web2py 1.96.2Web2py Web2py 1.96.1Web2py Web2py 1.95.1Web2py Web2py 1.94.6Web2py Web2py 1.90.6Web2py Web2py 1.90.5Web2py Web2py 1.90.4Web2py Web2py 1.90.2Web2py Web2py 1.90.1Web2py Web2py 1.83.2Web2py Web2py 1.83.1Web2py Web2py 1.99.7Web2py Web2py 1.99.4Web2py Web2py 1.99.3Web2py Web2py 1.99.2Web2py Web2py 1.94.1Web2py Web2py 1.93.2Web2py Web2py 1.93.1Web2py Web2py 1.92.1Web2py Web2py 1.87.2Web2py Web2py 1.87.1Web2py Web2py 1.86.3
9.8
CVSSv3
CVE-2016-10321
web2py prior to 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote malicious user to perform brute-force attacks.
Web2py Web2py
7.8
CVSSv3
CVE-2016-3952
web2py prior to 2.14.1, when using the standalone version, allows remote malicious users to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote malicious users to gain administrative access.
Web2py Web2py
9.8
CVSSv3
CVE-2016-3953
The sample web application in web2py prior to 2.14.2 might allow remote malicious users to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.
Web2py Web2py
5.5
CVSSv3
CVE-2016-3954
web2py prior to 2.14.2 allows remote malicious users to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by remote malicious users to execute arbitrary code using CVE-2016-3957.
Web2py Web2py
9.8
CVSSv3
CVE-2016-3957
The secure_load function in gluon/utils.py in web2py prior to 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote malicious users to execute arbitrary code by leveraging knowledge of encryption_key.
Web2py Web2py
7.5
CVSSv3
CVE-2016-4806
Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.
Web2py Web2py
4.8
CVSSv3
CVE-2016-4807
Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an malicious user to perform an XSS attack on logged in user (admin).
Web2py Web2py
8.8
CVSSv3
CVE-2016-4808
Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an malicious user to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a U...
Web2py Web2py
9.8
CVSSv3
CVE-2023-45158
An OS command injection vulnerability exists in web2py 2.24.1 and previous versions. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
Web2py Web2py
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-21111CVE-2024-32884IDORCVE-2023-1000CVE-2024-33260CVE-2024-3682reflected XSSrace conditionCVE-2024-3400
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook