582 matches found
CVE-2023-47890
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload...
CVE-2023-47890
CVE-2023-47890 affects pyLoad 0.5.0 and describes an Unrestricted File Upload via the edit_package flow, enabling arbitrary filesystem writes and potential remote code execution. Public documents corroborate a path-traversal/unauthorized-folder issue in the Python-based pyLoad web UI, with PoCs a...
pyLoad Access Control Error Vulnerability
pyload is a free and open source download manager written in Python, designed to be extremely lightweight, easily extensible and fully manageable over the Web. An access control error vulnerability exists in versions prior to pyLoad 0.5.0b3.dev76, which stems from allowing an unauthenticated...
pyload injection vulnerability
pyload is a free and open source download manager written in Python, designed to be extremely lightweight, easily extensible and fully manageable over the Web. An injection vulnerability exists in versions prior to pyLoad 0.5.0b3.dev76, which stems from the presence of a log injection vulnerabili...
CVE-2023-47890
pyLoad 0.5.0 is vulnerable to Unrestricted File Upload...
pyload Security Vulnerabilities
pyload is a free and open source download manager written in Python, designed to be extremely lightweight, easily extensible and fully manageable over the Web. A security vulnerability exists in pyLoad version 0.5.0 that stems from vulnerability to unrestricted file uploads...
PT-2024-18994
Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev77 Description Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET KEY variable. This issue allows attackers to access sensitive information, which could ha...
Download to arbitrary folder can lead to RCE
Summary A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts. Details When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a...
GHSA-H73M-PCFW-25H2 Download to arbitrary folder can lead to RCE
Summary A web UI user can store files anywhere on the pyLoad server and gain command execution by abusing scripts. Details When a user creates a new package, a subdirectory is created within the /downloads folder to store files. This new directory name is derived from the package name, except a...
PT-2023-30657
Name of the Vulnerable Software and Affected Versions pyLoad version 0.5.0 Description The issue allows an authenticated user to upload files to arbitrary locations on the server, potentially leading to command execution by abusing scripts. When creating a new package, a subdirectory is created...
PyLoad 0.5.0 - Pre-auth Remote Code Execution Exploit
Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import requests, argparse...
Exploit for Code Injection in Pyload
CVE-2023-0297 https:...
PyLoad 0.5.0 Remote Code Execution
Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...
PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)
Exploit Title: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE Date: 06-10-2023 Credits: bAu @bauh0lz Exploit Author: Gabriel Lima 0xGabe Vendor Homepage: https://pyload.net/ Software Link: https://github.com/pyload/pyload Version: 0.5.0 Tested on: Ubuntu 20.04.6 CVE: CVE-2023-0297 import...
Exploit for Code Injection in Pyload
CVE-2023-0297 Unauthenticated Remote Code Exec...
pyLoad js2py Python Execution Exploit
pyLoad versions prior to 0.5.0b3.dev31 are vulnerable to Python code injection due to the pyimport functionality exposed through the js2py library. An unauthenticated attacker can issue a crafted POST request to the flash/addcrypted2 endpoint to leverage this for code execution. pyLoad by default...
pyLoad js2py Python Execution
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'rex/stopwatch' class MetasploitModule 'pyLoad js2py Python Execution', 'Description' = %q pyLoad versions prior to 0.5.0b3.dev31 are vulnerable to Python code...