web2py

Every one of the 14 is a mark on the map. Named now: 1 to 14, most at risk first.

1. Web2py URL - Open RedirectCVE-2023-22432web2py · CVSS 6.1 · 2.4% likely

   CWE-601

2. Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files.CVE-2016-4806Web2py · 10% likely

   CWE-200

3. The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to ex…CVE-2016-3957Web2py · 4.9% likely

   CWE-502

4. An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a c…CVE-2023-45158web2py · 4.4% likely

   CWE-78

5. The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the…CVE-2016-3953Web2py · 3.3% likely

   CWE-798

6. web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.CVE-2016-10321Web2py · 2.6% likely

   CWE-254

7. Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).CVE-2016-4807Web2py · 2.3% likely

   CWE-79

8. Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user…CVE-2022-33146web2py · 1.9% likely

   CWE-601

9. Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actio…CVE-2016-4808Web2py · 1.8% likely

   CWE-352

10. web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by r…CVE-2016-3954Web2py · 1.4% likely

    CWE-200

11. Cross-site scripting (XSS) vulnerability in static/js/share.js (aka the social bookmarking widget) in Web2py before 2.3.1 allows remote attackers to inject arbitrary web script or…CVE-2013-2311Web2py · 1.2% likely

    CWE-79

12. web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify.…CVE-2016-3952Web2py · 1.1% likely

    CWE-255

13. Open redirect vulnerability in gluon/tools.py in Web2py 2.9.11 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the _next…CVE-2015-6961Web2py · 1.0% likely

    CWE-601

14. web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an…CVE-2026-25198web2py · CVSS 5.1 · 0.3% likely

    CWE-601

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.