Cross-Site Scripting (XSS)

bepasty is vulnerable to cross-site scripting XSS attacks. A malicious user can inject and execute arbitrary javascript via the download.py file because it renders content as html rather than converting it to text first...

Information Disclosure

bepasty is vulnerable to information disclosure. A user that's not an admin can access the metadata of locked files...