weblate vulnerabilities (PyPI)
38 vulnerabilities.
-
weblatePyPI Weblate:: WebIDOR in GroupViewSet allows authenticated project manager to gain unauthorized read access to any private project 8.1 High -
weblatePyPI Observable object existence disclosure in private Weblate projects via globally scoped object lookups 4.3 Medium -
weblatePyPI Weblate SSRF: outbound URL guard misses the NAT64 well-known prefix (64:ff9b::/96) 5.9 Medium -
weblatePyPI Weblate: Stored HTML injection in editor search preview 4.6 Medium -
weblatePyPI Weblate is vulnerable to XSS via crafted Markdown 4.3 Medium -
weblatePyPI Weblate: Private Translation Enumeration via Screenshot API 4.3 Medium -
weblatePyPI Weblate is Vulnerable to Authenticated SSRF via Project Backup Import bypassing validate_repo_url 5.3 Medium -
weblatePyPI Weblate's API Token Not Invalidated on Password Change 4.2 Medium -
weblatePyPI Weblate: Prefix-Based Repository Boundary Check Bypass via Symlink/Junction Path Prefix Collision 5.0 Medium -
weblatePyPI Weblate: SSRF via the webhook add-on using unprotected fetch_url() 4.1 Medium -
weblatePyPI Weblate: Privilege escalation in the user API endpoint 8.8 High -
weblatePyPI Weblate: SSRF via Project-Level Machinery Configuration 5.0 Medium -
weblatePyPI Weblate: Arbitrary File Read via Symlink 7.7 High -
weblatePyPI Weblate: Authenticated SSRF via redirect bypass of ALLOWED_ASSET_DOMAINS in screenshot URL uploads 5.0 Medium -
weblatePyPI Weblate: Remote code execution during backup restoration 8.1 High -
weblatePyPI Weblate: JavaScript localization CDN add-on allows arbitrary local file read outside the repository 6.8 Medium -
weblatePyPI Weblate has improper access control for the translation memory API 4.3 Medium -
weblatePyPI Weblate: Improper access control for pending tasks in API 3.1 Low -
weblatePyPI Weblate: Missing access control for the AddonViewSet API exposes all addon configurations 4.3 Medium -
weblatePyPI Weblate has an argument injection in management console 6.6 Medium -
weblatePyPI Weblate leaks information via screenshots 2.3 Low -
weblatePyPI Weblate has git config file overwrite vulnerability that leads to remote code execution 9.1 Critical -
weblatePyPI Weblate has an arbitrary file read via symbolic links 7.7 High -
weblatePyPI Weblate has Server-Side Request Forgery vulnerability 5.0 Medium -
weblatePyPI Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR) 4.3 Medium -
weblatePyPI Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration 5.3 Medium -
weblatePyPI Weblate has improper validation upon invitation acceptance 1.0 Low -
weblatePyPI Weblate leaks the IP of project members inviting users to assume reviewer roles in Audit log 2.6 Low -
weblatePyPI Weblate integration with Anubis can lead to Open Redirect via redir parameter 2.1 Low -
weblatePyPI Weblate has long session expiry times during second factor verification 2.1 Low -
weblatePyPI Weblate exposes personal IP address via e-mail 2.1 Low -
weblatePyPI Weblate lacks rate limiting when verifying second factor 4.9 Medium -
weblatePyPI Weblate VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext 2.2 Low -
weblatePyPI Weblate vulnerabler to improper sanitization of project backups 4.4 Medium -
weblatePyPI Remote Code Execution (RCE) 7.2 High -
weblatePyPI Duplicate Advisory: Command injection in Weblate 8.7 High -
weblatePyPI Cross-site Scripting in Weblate 5.4 Medium -
weblatePyPI Weblate user account enumeration via reset password form 5.3 Medium