CVE-2026-33992 pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration

pyLoad is a free and open-source download manager written in Python. Prior to version 0.5.0b3.dev97, PyLoad's download engine accepts arbitrary URLs without validation, enabling Server-Side Request Forgery SSRF attacks. An authenticated attacker can exploit this to access internal network service...

EUVD-2026-16886

pyLoad: Server-Side Request Forgery via Download Link Submission Enables Cloud Metadata Exfiltration...

EUVD-2018-0774

Malware in sbrugna...

EUVD-2024-16235

Malicious code in bioql PyPI...

CVE-2024-0440

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files...

CVE-2024-0440

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files...

CVE-2024-0440

Attacker, with permission to submit a link or submits a link via POST to be collected that is using the file:// protocol can then introspect host files and other relatively stored files...

CVE-2024-0440

CVE-2024-0440 describes an SSRF-type flaw where an attacker with permission to submit a link or submit via POST a link using the file:// protocol can introspect host files and other relatively stored files. Affected exposure is described across multiple feeds; CVSS data vary by source (NVD: 3.1, ...

Sql injection

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magicquotesgpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submitinfo parameter in a link submission action. NOTE: it was later...

CVE-2008-1918

SQL injection vulnerability in submit.php in PHP-Fusion 6.01.14 and 6.00.307, when magicquotesgpc is disabled and the database table prefix is known, allows remote authenticated users to execute arbitrary SQL commands via the submitinfo parameter in a link submission action. NOTE: it was later...