CVE-2023-45158

<= 2.24.1

An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler

9.8CRITICAL

CVE-2023-22432

< 2.23.1

Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an

6.1MEDIUM

CVE-2022-33146

< 2.22.5

Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web sit

6.1MEDIUM

CVE-2016-3957

< 2.14.2

The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in

9.8CRITICAL

CVE-2016-3954

< 2.14.2

web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_exampl

5.5MEDIUM

CVE-2016-3953

< 2.14.2

The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving us

9.8CRITICAL

CVE-2016-3952

< 2.14.1

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direc

7.8HIGH

CVE-2015-6961

all versions

Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites an

6.1MEDIUM

CVE-2016-10321

<= 2.14.5

web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform

9.8CRITICAL

CVE-2016-4808

<= 2.14.5

Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to tric

8.8HIGH

CVE-2016-4807

<= 2.14.5

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on

4.8MEDIUM

CVE-2016-4806

<= 2.14.5

Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to rea

7.5HIGH

CVE-2013-2311

<= 2.2.1

Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows r