Web2py is a full-stack Python web framework with a modest but well-represented presence in the landscape, concentrating vulnerability exposure in its core application platform. The vendor's disclosures skew toward serious outcomes and frequently acquire public exploit code; recurring weaknesses center on web-tier input handling and trust boundary violations, including open redirects, cross-site scripting, cross-site request forgery, sensitive information exposure, and unsafe deserialization of untrusted data—patterns characteristic of framework-level flaws that can propagate across dependent applications. Defenders should treat Web2py advisories as security-relevant and validate that applications built on the framework receive timely updates; current severity and exploitation activity are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Web2py over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4806HIGH Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files. | Jan 11, 2017 | 7.5 | 40 | NO | YES |
CVE-2016-4808HIGH Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted action | Jan 11, 2017 | 8.8 | 39 | NO | YES |
CVE-2023-22432MEDIUM Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted | Mar 6, 2023 | 6.1 | 31 | NO | YES |
CVE-2016-10321CRITICAL web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks. | Apr 10, 2017 | 9.8 | 31 | NO | NO |
CVE-2023-45158CRITICAL An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a cr | Oct 16, 2023 | 9.8 | 30 | NO | NO |
CVE-2016-4807MEDIUM Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin). | Jan 11, 2017 | 4.8 | 29 | NO | YES |
CVE-2016-3957CRITICAL The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to exe | Feb 6, 2018 | 9.8 | 28 | NO | NO |
CVE-2016-3953CRITICAL The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the s | Feb 6, 2018 | 9.8 | 28 | NO | NO |
CVE-2016-3952HIGH web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. | Feb 6, 2018 | 7.8 | 23 | NO | NO |
CVE-2016-3954MEDIUM web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by r | Feb 6, 2018 | 5.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Web2py.
Media articles that mention a CVE ID that affects a product developed by Web2py — matched by CVE ID, not by vendor name.