Web2py
14 CVEs across 1 Web2py products. Browse Web2py vulnerabilities, severities, and proof-of-concept exploits.
Web2py products with known CVEs
Web2py CVEs — newest first| CVE | Severity | Score | Published | Summary |
|---|
CVE-2026-25198 | Medium | 4.7 | 2026-02-05 | web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may… |
CVE-2023-45158 | Critical | 9.8 | 2023-10-16 | An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default… |
CVE-2023-22432 | Medium | 6.1 | 2023-03-06 | Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessin… |
CVE-2022-33146 | Medium | 6.1 | 2022-06-27 | Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing atta… |
CVE-2016-3957 | Critical | 9.8 | 2018-02-06 | The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow re… |
CVE-2016-3954 | Medium | 5.5 | 2018-02-06 | web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue… |
CVE-2016-3953 | Critical | 9.8 | 2018-02-06 | The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption k… |
CVE-2016-3952 | High | 7.8 | 2018-02-06 | web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templat… |
CVE-2015-6961 | Medium | 6.1 | 2017-10-18 | Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks vi… |
CVE-2016-10321 | Critical | 9.8 | 2017-04-10 | web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks. |
CVE-2016-4808 | High | 8.8 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform… |
CVE-2016-4807 | Medium | 4.8 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin). |
CVE-2016-4806 | High | 7.5 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive… |
CVE-2013-2311 | | | 2013-05-22 | Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows remote attackers to inject arb… |