Pyload vulnerabilities
53 CVEs and advisories name Pyload as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-29778pyLoad: Arbitrary File Write via Path Traversal in edit_package()
- CVE-2025-61773pyLoad CNL and captcha handlers allow code Injection via unsanitized parameters
- CVE-2025-57751Denial-of-Service attack in pyLoad CNL Blueprint using dukpy.evaljs
- CVE-2025-55156PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
- CVE-2025-54802pyLoad CNL Blueprint is vulnerable to Path Traversal through `dlc_path` leading to Remote Code Execution (RCE)
- CVE-2025-54140pyLoad has Path Traversal Vulnerability in json/upload Endpoint that allows Arbitrary File Write
- CVE-2025-53890pyLoad vulnerable to remote code execution through js2py onCaptchaResult
- CVE-2025-7346Any unauthenticated attacker can bypass the localhost restrictions posed by the application and utilize this to create arbitrary packages
- CVE-2024-1240Open Redirection in pyload/pyload
- CVE-2024-47821pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
- CVE-2024-32880pyLoad allows upload to arbitrary folder lead to RCE
- CVE-2024-24808pyLoad open redirect vulnerability due to improper validation of the is_safe_url function
- CVE-2024-22416Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
- CVE-2024-21644pyLoad unauthenticated flask configuration leakage
- CVE-2024-21645pyLoad Log Injection
- CVE-2023-0509Improper Certificate Validation in pyload/pyload
- CVE-2023-0488Cross-site Scripting (XSS) - Stored in pyload/pyload
- CVE-2023-0435Excessive Attack Surface in pyload/pyload
- CVE-2023-0434Improper Input Validation in pyload/pyload
- CVE-2023-0297 Code Injection in pyload/pyload
- CVE-2023-0227Insufficient Session Expiration in pyload/pyload
- CVE-2023-0057Improper Restriction of Rendered UI Layers or Frames in pyload/pyload
- CVE-2023-0055Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload