CVE-2023-0488Medium· 5.4▾ SunlitCross-site Scripting in pyload-ng
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
0.8% → 0.8%
Cross-site Scripting (XSS) - Stored in GitHub repository pyload/pyload prior to 0.5.0b3.dev42.
pyload-ng < 0.5.0b3.dev42Upgrade to a patched release:
pyload-ng 0.5.0b3.dev42Connected by shared product, vendor, weakness, or advisory.
GHSA-fr26-jjhm-638cHighpyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)
GHSA-p3pr-8f3m-4qp8Medium· 6.4pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification host
GHSA-889w-m37p-88m5High· 7.5pyLoad: Api.set_user_permission never invalidates the target's session
GHSA-jq7h-wrvp-3rgxHigh· 7.5pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's session
GHSA-68w4-83fh-f2w8High· 8.1pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator password
GHSA-9q47-3cm2-2rp8MediumpyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` Header