CVE-2024-39205-Pyload-RCE

CVE-2024-39205-Pyload-RCE Pyload RCE with js2py sandbox escape Summary Any pyload-ng running under python3.11 or below are vulnerable under RCE. Attacker can send a request containing any shell command and the victim server will execute it immediately. Fix Upgrade to the newest version of pyload-...

CVE-2023-0297_Pre-auth_RCE_in_pyLoad

CVE-2023-0297: Pre-auth RCE in pyLoad The Story of Finding Pre-auth RCE in pyLoad TL;DR A code injection vulnerability in pyLoad versions prior to 0.5.0b3.dev31 leads to pre-auth RCE by abusing js2py's functionality. You can find the report here and exploit code here. Details pyLoad is an OSS...

pyload-ng js2py - Remote Code Execution

An issue in the component js2py.disablepyimport of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call. id: CVE-2024-28397 info: name: pyload-ng js2py - Remote Code Execution author: iamnoooob,rootxharsh,pdresearch severity: medium description: | An issue in the...

pyLoad Flask Config - Access Control

pyLoad is the free and open-source Download Manager written in pure Python. Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRETKEY variable. This issue has been patched in version 0.5.0b3.dev77. id: CVE-2024-21644 info: name: pyLoad Flask Config ...

pyload - Log Injection

A log injection vulnerability was identified in pyload. This vulnerability allows any unauthenticated actor to inject arbitrary messages into the logs gathered by pyload. id: CVE-2024-21645 info: name: pyload - Log Injection author: isacaya severity: medium description: | A log injection...

CVE-2023-0297

CVE-2023-0297 RCE in pyload prior to 0.5.0b3.dev31. Disclaimer: This script lead to unauthorized access or control of a remote system; only use it if you have explicit permission from the system owner before proceeding...

Remote-Code-Execution-CVE-2024-28397-pyload-ng-js2py-

Remote Code Execution – CVE-2024-28397 pyload-ng / js2py This repository contains a Proof-of-Concept PoC exploit for CVE-2024-28397 , a Remote Code Execution vulnerability affecting pyload-ng due to insecure usage of js2py. Disclaimer: This PoC is for educational and research purposes only. Do no...

CVE-2023-0297

CVE-2023-0297 Unauthenticated Remote Code Execution in PyLoad 0.5.0b3.dev31 DISCLAIMER: This script is made to audit the security of systems. Only use this script on your own systems or on systems you have written permission to exploit...

ensimag-secu3a-cve-2024-22416

CVE-2024-22416 Reference report: GHSA-pgpj-v85q-h5fm This repository contains a docker compose configuration that setups both a pyLoad server and an attacker server that just provides a csrf.html. To test yourself, just run docker composer up you need to have docker composer installed additionall...

CVE-2023-0297

pyloadCVE-2023-0297poc A code injection vulnerability in pyLoad versions prior to 0.5.0b3.dev31 leads to pre-auth RCE by abusing js2py's functionality. use Usage of CVE-2023-0297poc.exe: -f string fileName:IP.txt -u string example:http://127.0.0.1:8080...

PYSEC-2026-4292 pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo

Summary The /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc. is protected by @loginrequired, but the underlying templates for all of these pages...

PYSEC-2026-4293 pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination

Description: The API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the underlying function. Since there is no size limit set at this point, a large file uploa...

PyLoad 0.5.0 - Pre-auth Remote Code Execution (RCE)

Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31. id: CVE-2023-0297 info: name: PyLoad 0.5.0 - Pre-auth Remote Code Execution RCE author: MrHarshvardhan,DhiyaneshDk severity: critical description: | Code Injection in GitHub repository pyload/pyload prior to 0.5.0b3.dev31...

CVE-2026-75597

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the /web/ route in src/pyload/webui/app/blueprints/appblueprint.py renders Jinja2 templates without any authentication requirement. Every equivalent direct route /logs, /settings, /queue, /dashboard, etc...

CVE-2026-48484

pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API rpc function in apiblueprint.py handles multipart/form-data uploads by reading the whole content of the uploaded file into memory with file.read. This occurs before the data is sent to the...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-68W4-83FH-F2W8...

GHSA-68W4-83FH-F2W8 pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password

Summary Api.getUserData legacy and Api.getuserdata are declared with @permissionPerms.ANY and are reachable at /api/getUserData and /api/getuserdata. Because Perms.ANY == 0 and pyLoad's permission check is a bitmask AND, that gate is a no-op: every authenticated account passes, including one...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-68W4-83FH-F2W8...

GHSA-9Q47-3CM2-2RP8 pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header

Summary pyLoad determines the "client IP" used for its rate-limiting decorator and for its security/audit logging by reading the client-supplied X-Forwarded-For XFF HTTP header and taking the leftmost value. No trusted-proxy configuration exists the Cheroot WSGI server faces clients directly, and...

ez-pyload (>=1.0.0, <=1.0.4) potentially affected by unknown CVE via pyload-ng (0.5.0b3.dev101)

pyload-ng PYPI version 0.5.0b3.dev101 is affected by a known vulnerability. The following packages have a transitive dependency on pyload-ng and may be impacted: - ez-pyload =1.0.0, =1.0.4 Source cves: unknown CVE Source advisory: GHSA-9Q47-3CM2-2RP8...