Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

web2py

8 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
8 · 2 medium
Registry
PyPI

Advisories 8

  • CVE-2026-25198Medium 4.7

    web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability.

    Affected: fixed in 3.1.1.

  • CVE-2023-22432Medium 6.1

    Open redirect vulnerability exists in web2py versions prior to 2.23.1.

    Affected: fixed in 2.23.1.

  • Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and…

    Affected: fixed in 2.22.5.

  • web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status.

    Affected: fixed in 2.14.2.

  • The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a…

    Affected: fixed in 2.14.2.

  • web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform…

    Affected: fixed in 2.14.6.

  • Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a…

    Affected: fixed in 2.14.6.

  • Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged…

    Affected: through 2.14.5.