CVE Feed

    Dashboard / CVE / CVE-2016-4807

    CVE-2016-4807

    Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).

    Published:Jan 11, 2017
    Last Modified:Apr 20, 2025
    EPS:Jan 11, 2017
    EPSS Score:0.00464
    CVSS Score:4.8

    Affected Products

    Vendor
    Web2py
    Product
    Web2py

    Exploits

    http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.htmlhttps://www.exploit-db.com/exploits/39821/http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.htmlhttps://www.exploit-db.com/exploits/39821/https://www.exploit-db.com/exploits/39821

    Related CVEs

    CVE-2026-25198 (CVSS 5.1) — web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. …
    CVE-2023-45158 (CVSS 9.8) — An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to u…
    CVE-2023-22432 (CVSS 6.1) — Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may …
    CVE-2022-33146 (CVSS 6.1) — Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to …
    CVE-2016-3953 (CVSS 9.8) — The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via …
    CVE-2016-3954 (CVSS 5.5) — web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to ex…
    CVE-2016-3952 (CVSS 7.8) — web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variabl…
    CVE-2016-3957 (CVSS 9.8) — The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session in…
    CVE-2015-6961 (CVSS 6.1) — Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to ar…
    CVE-2016-10321 (CVSS 9.8) — web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High