Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 21, 2026web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/contrCVE-2026-79318 · Other software · reported by MITREMedium 6.5
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 5, 2026web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability.CVE-2026-25198 · Other software · web2py · reported by vultures@jpcert.or.jpMedium 5.1
web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
- Product
- web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 16, 2023An OS command injection vulnerability exists in web2py 2.24.1 and earlier.CVE-2023-45158 · Other software · web2py · reported by vultures@jpcert.or.jpCritical 9.8
An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
- Product
- web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2023Open redirect vulnerability exists in web2py versions prior to 2.23.1.CVE-2023-22432 · Other software · web2py · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.
- Product
- web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2022Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attacCVE-2022-33146 · Other software · web2py · reported by vultures@jpcert.or.jpMedium 6.1
Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
- Product
- web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remCVE-2016-3957 · Other software · Web2py · reported by MITRECritical 9.8
The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to execute arbitrary code by leveraging knowledge of encryption_key.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.CVE-2016-3954 · Other software · Web2py · reported by MITREMedium 5.5
web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by remote attackers to execute arbitrary code using CVE-2016-3957.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddevco.reusn.ubuntu.com
Feb 6, 2018The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption keCVE-2016-3953 · Other software · Web2py · reported by MITRECritical 9.8
The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the session.connect function.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2018web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/templateCVE-2016-3952 · Other software · Web2py · reported by MITREHigh 7.8
web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 18, 2017Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks viaCVE-2015-6961 · Other software · Web2py · reported by MITREMedium 6.1
Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the _next parameter to user/logout.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 10, 2017web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.CVE-2016-10321 · Other software · Web2py · reported by MITRECritical 9.8
web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 11, 2017Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform CVE-2016-4808 · Other software · Web2py · reported by MITREHigh 8.8
Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 11, 2017Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).CVE-2016-4807 · Other software · Web2py · reported by MITREMedium 4.8
Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Jan 11, 2017Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive CVE-2016-4806 · Other software · Web2py · reported by MITREHigh 7.5
Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
May 22, 2013Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows remote attackers to inject arbiCVE-2013-2311 · Other software · Web2py · reported by vultures@jpcert.or.jpMedium 4.3
Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Product
- Web2py
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.