WS-2016-0137

In bepasty, versions prior to 0.3.0, are vulnerable to XSS via the "download.py" file. Since bepasty renders content as HTML, instead of plain-text, an attacker may leverage this vulnerability in order to execute malicious javascript code on the victim's endpoint...

Cross-Site Scripting (XSS)

bepasty is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the download.py file because it renders content as html rather than converting it to text first...

Information Disclosure

bepasty is vulnerable to information disclosure. A user that's not an admin can access the metadata of locked files...