Web2py Web2py vulnerabilities

• web2py web2py has an Open Redirect Vulnerability CVE-2026-25198 Fix available 5.1 MediumFebruary 5, 2026
• web2py An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is... CVE-2023-45158 Public exploit 9.8 CriticalOctober 16, 2023
• web2py Open redirect in web2py CVE-2023-22432 Public exploitFix available 6.1 MediumMarch 5, 2023
• web2py Open redirect in web2py CVE-2022-33146 Fix available 6.1 MediumJune 27, 2022
• web2py The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to... CVE-2016-3957 Public exploitFix available 9.8 CriticalFebruary 6, 2018
• web2py web2py exposure of sensitive information CVE-2016-3954 Fix available 5.5 MediumFebruary 6, 2018
• web2py web2py remote code execution via hardcoded encryption key in session.connect function CVE-2016-3953 Fix available 9.8 CriticalFebruary 6, 2018
• web2py web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain... CVE-2016-3952 Fix available 7.8 HighFebruary 6, 2018
• web2py Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to... CVE-2015-6961 6.1 MediumOctober 18, 2017
• web2py web2py is vulnerable to password brute-force attack CVE-2016-10321 Fix available 9.8 CriticalApril 10, 2017
• web2py Web2py Cross-Site Request Forgery vulnerability CVE-2016-4808 Public exploitFix available 8.8 HighJanuary 11, 2017
• web2py Web2py Reflected XSS vulnerability CVE-2016-4807 Public exploit 4.8 MediumJanuary 11, 2017
• web2py Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows... CVE-2016-4806 Public exploit EPSS 10.1% 7.5 HighJanuary 11, 2017
• web2py Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget... CVE-2013-2311 4.3 MediumMay 22, 2013