CVE Feed

    Dashboard / CVE / CVE-2026-25198

    CVE-2026-25198

    web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

    Published:Feb 5, 2026
    Last Modified:Apr 17, 2026
    EPS:Feb 5, 2026
    EPSS Score:0.00013
    CVSS Score:4.7

    Affected Products

    Vendor
    Web2py
    Product
    Web2py

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2023-45158 (CVSS 9.8) — An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to u…
    CVE-2023-22432 (CVSS 6.1) — Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may …
    CVE-2022-33146 (CVSS 6.1) — Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to …
    CVE-2016-3953 (CVSS 9.8) — The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via …
    CVE-2016-3954 (CVSS 5.5) — web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to ex…
    CVE-2016-3952 (CVSS 7.8) — web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variabl…
    CVE-2016-3957 (CVSS 9.8) — The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session in…
    CVE-2015-6961 (CVSS 6.1) — Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to ar…
    CVE-2016-10321 (CVSS 9.8) — web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote…
    CVE-2016-4808 (CVSS 8.8) — Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High