CSRF was discovered in the web UI in Deluge before 1.3.14. The exploitation methodology involves (1) hosting a crafted plugin that executes an arbitrary program from its init .py file and (2) causing the victim to download, install, and enable this plugin.
8.8CVSS
8.3AI Score
0.01EPSS
The WebUI component in Deluge before 1.3.15 contains a directory traversal vulnerability involving a request in which the name of the render file is not associated with any template file.
9.8CVSS
8.9AI Score
0.004EPSS
The Deluge Web-UI is vulnerable to XSS through a crafted torrent file. The the data from torrent files is not properly sanitised as it's interpreted directly as HTML. Someone who supplies the user with a malicious torrent file can execute arbitrary Javascript code in the context of the user's brows...
6.1CVSS
6AI Score
0.001EPSS