CVE-2020-15801Critical· 9.8▾ MidnightIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.7 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
3.5%
3.5% → 3.6%
In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <executable-name>._pth file (e.g., the python._pth file) is not affected.
python >= 3.7.0, < 3.7.9python >= 3.8.0, < 3.8.5max_dataUpgrade past the affected range:
python 3.8.5Connected by shared product, vendor, weakness, or advisory.
CVE-2022-26488High· 7.0In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured
CVE-2023-24329High· 7.5An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVE-2022-48560High· 7.5A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVE-2022-45061High· 7.5An issue was discovered in Python before 3.11.1
CVE-2022-0391High· 7.5A flaw was found in Python, specifically within the urllib.parse module
CVE-2021-28861High· 7.4Python 3.x through 3.10 has an open redirection vulnerability in lib/http/server.py due to no protection against multiple (/) at the beginning of URI path which may leads to information disclosure