Pyload Pyload 0.5.0
Approved changes feed: RSS · Atom
cpe:2.3:a:pyload:pyload:0.5.0:*:*:*:*:*:*:*
part: a version: 0.5.0 update: *
| Vendor | Pyload (13d569a8-bee6-54cc-aa16-925a7cdd1dac) |
|---|---|
| Product | Pyload (86814d7e-fd3c-5461-9fd5-8a68245895cb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/pyload/pyload |
purl2cpe | 2026-06-01 10:15:37.858257 |
pkg:gitlab/pyload/pyload |
purl2cpe | 2026-06-01 10:15:37.858259 |
pkg:pypi/pyload-ng |
purl2cpe | 2026-06-01 10:15:37.858260 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-33992 |
vulnerable | 2026-06-08 07:59:11.669090 |
pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration
pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery (SSRF) attacks. An authenticated attacker can exploit this to access internal network services and exfiltrate cloud provider metadata. On DigitalOcean droplets, this exposes sensitive infrastructure data including droplet ID, network configuration, region, authentication keys, and SSH keys configured in user-data/cloud-init. Version 0.5.0b3.dev97 contains a patch.
Published: 2026-03-27T22:12:39.606Z
Updated: 2026-03-30T18:29:06.744Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-47821 |
vulnerable | 2026-06-08 06:48:13.314109 |
pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot API
CRITICAL (9.1)
pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are completed, for e.g. a download is finished. By downloading a executable file to a folder in /scripts and performing the respective action, remote code execution can be achieved in versions prior to 0.5.0b3.dev87. A file can be downloaded to such a folder by changing the download folder to a folder in `/scripts` path and using the `/flashgot` API to download the file. This vulnerability allows an attacker with access to change the settings on a pyload server to execute arbitrary code and completely compromise the system. Version 0.5.0b3.dev87 fixes this issue.
Published: 2024-10-25T22:48:57.950Z
Updated: 2024-10-28T19:41:54.018Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1240 |
vulnerable | 2026-06-08 06:25:39.649887 |
Open Redirection in pyload/pyload
MEDIUM (4.6)
An open redirection vulnerability exists in pyload/pyload version 0.5.0. The vulnerability is due to improper handling of the 'next' parameter in the login functionality. An attacker can exploit this vulnerability to redirect users to malicious sites, which can be used for phishing or other malicious activities. The issue is fixed in pyload-ng 0.5.0b3.dev79.
Published: 2024-11-15T10:57:07.797Z
Updated: 2024-11-15T19:07:26.471Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-47890 |
vulnerable | 2026-06-08 06:14:25.908634 |
Details available
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.
Published: 2024-01-08T00:00:00.000Z
Updated: 2026-07-09T00:29:01.952Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0055 |
vulnerable | 2026-06-08 05:52:04.176304 |
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload
LOW (3.1)
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32.
Published: 2023-01-04T00:00:00.000Z
Updated: 2025-04-09T15:32:47.320Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.