pyload-ng vulnerabilities (PyPI)
58 vulnerabilities.
-
pyload-ngPyPI pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password 8.1 High -
pyload-ngPyPI pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header 6.9 Medium -
pyload-ngPyPI pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session 7.5 High -
pyload-ngPyPI pyLoad: Api.set_user_permission never invalidates the target's session 7.5 High -
pyload-ngPyPI pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host 6.4 Medium -
pyload-ngPyPI pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=) 7.7 High -
pyload-ngPyPI pyLoad has an authentication bypass in API key validation (check_apikey cache) 8.1 High -
pyload-ngPyPI pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo 5.3 Medium -
pyload-ngPyPI pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination 6.5 Medium -
pyload-ngPyPI pyLoad: Unbounded Memory Growth Leading to DoS and Potential DDoS in EventManager 6.5 Medium -
pyload-ngPyPI pyLoad: SSRF guard bypass via IPv6 6to4/NAT64 transition wrappers of internal IPs 4.9 Medium -
pyload-ngPyPI pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API 5.0 Medium -
pyload-ngPyPI pyLoad: Stored XSS in Downloads view via unsanitized link URL in packages.js template literal 8.7 High -
pyload-ngPyPI pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory 6.5 Medium -
pyload-ngPyPI pyLoad: Unauthenticated traceback disclosure via global exception handler in WebUI 5.3 Medium -
pyload-ngPyPI pyLoad: Path Traversal via Package Folder Name in set_package_data 8.1 High -
pyload-ngPyPI pyLoad: Path Traversal via Package Folder Name 6.5 Medium -
pyload-ngPyPI pyload-ng: non-admin SETTINGS users can redirect all outbound traffic through an attacker-controlled proxy 8.3 High -
pyload-ngPyPI pyload-ng: non-admin SETTINGS users can disable outbound TLS peer verification 6.8 Medium -
pyload-ngPyPI pyLoad: Session Cookie Security Downgrade via Untrusted X-Forwarded-Proto Header Spoofing (Global State Race Condition) 4.8 Medium -
pyload-ngPyPI pyLoad's Session Not Invalidated After Permission Changes 2.9 Low -
pyload-ngPyPI pyLoad has Stale Session Privilege After Role/Permission Change (Privilege Revocation Bypass) 8.8 High -
pyload-ngPyPI pyLoad WebUI JSON permission mismatch lets ADD/DELETE users invoke MODIFY-only actions 5.4 Medium -
pyload-ngPyPI pyLoad has an Incomplete Tar Path Traversal Fix in UnTar._safe_extractall via os.path.commonprefix Bypass 5.3 Medium -
pyload-ngPyPI Authorization Bypass for SSL Certificate/Key Configuration Due to Option Name Mismatch in pyload-ng 6.8 Medium -
pyload-ngPyPI pyLoad has an incomplete fix for CVE-2026-33509: unprotected storage_folder enables arbitrary file write to Flask session store and code execution 7.5 High -
pyload-ngPyPI pyLoad has Improper Neutralization of Special Elements used in an OS Command 8.8 High -
pyload-ngPyPI pyLoad has SSRF fix bypass via HTTP redirect 9.3 Critical -
pyload-ngPyPI pyLoad has SSRF in parse_urls API endpoint via unvalidated URL parameter 7.7 High -
pyload-ngPyPI pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration 9.3 Critical -
pyload-ngPyPI pyload-ng: SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration 7.5 High -
pyload-ngPyPI pyload-ng: Improper Authentication and Origin Validation Error 6.5 Medium -
pyload-ngPyPI pyLoad: Arbitrary File Write via Path Traversal in edit_package() 7.1 High -
pyload-ngPyPI pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters 8.1 High -
pyload-ngPyPI Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs 7.7 High -
pyload-ngPyPI PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter 7.8 High -
pyload-ngPyPI pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE) 9.8 Critical -
pyload-ngPyPI Pyload log Injection via API /json/add_package in add_name parameter 4.3 Medium -
pyload-ngPyPI pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write 7.5 High -
pyload-ngPyPI pyLoad vulnerable to remote code execution through js2py onCaptchaResult 9.8 Critical -
pyload-ngPyPI pyLoad is vulnerable to attacks that bypass localhost restrictions, enabling the creation of arbitrary packages 8.7 High -
pyload-ngPyPI Open Redirection in pyload/pyload 4.6 Medium -
pyload-ngPyPI pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API 9.1 Critical -
pyload-ngPyPI pyload-ng vulnerable to RCE with js2py sandbox escape 9.8 Critical -
pyload-ngPyPI pyLoad allows upload to arbitrary folder lead to RCE 9.1 Critical -
pyload-ngPyPI pyLoad open redirect vulnerability due to improper validation of the is_safe_url function 4.7 Medium -
pyload-ngPyPI Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation 9.7 Critical -
pyload-ngPyPI pyLoad unauthenticated flask configuration leakage 7.5 High -
pyload-ngPyPI pyLoad Log Injection 5.3 Medium -
pyload-ngPyPI Download to arbitrary folder can lead to RCE 8.8 High - Show olderLoading…