Web2py
Vendor:
First CVE: May 22, 2013 · Active for 13 years
13
Total CVEs
More Total CVEs than 91% of tracked products
2.6
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 49% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Web2py over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 22, 2013
13 years ago
Most Recent CVE
Oct 16, 2023
1,012 days ago
CVE Severity & Scoring
Web2py13 CVEs
46%
23%
31%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (15.4%)
Network10 (76.9%)
Unknown1 (7.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low12 (92.3%)
High0 (0.0%)
Unknown1 (7.7%)
User Interaction
None7 (53.8%)
Unknown1 (7.7%)
Required5 (38.5%)
Privileges Required
Low2 (15.4%)
High1 (7.7%)
None9 (69.2%)
Unknown1 (7.7%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2016-4806HIGH Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive files. | Jan 11, 2017 | 7.5 | 40 | NO | YES |
CVE-2016-4808HIGH Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted action | Jan 11, 2017 | 8.8 | 39 | NO | YES |
CVE-2023-22432MEDIUM Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted | Mar 6, 2023 | 6.1 | 31 | NO | YES |
CVE-2016-10321CRITICAL web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks. | Apr 10, 2017 | 9.8 | 31 | NO | NO |
CVE-2023-45158CRITICAL An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a cr | Oct 16, 2023 | 9.8 | 30 | NO | NO |
CVE-2016-4807MEDIUM Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin). | Jan 11, 2017 | 4.8 | 29 | NO | YES |
CVE-2016-3957CRITICAL The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to deserialize session information stored in cookies, which might allow remote attackers to exe | Feb 6, 2018 | 9.8 | 28 | NO | NO |
CVE-2016-3953CRITICAL The sample web application in web2py before 2.14.2 might allow remote attackers to execute arbitrary code via vectors involving use of a hardcoded encryption key when calling the s | Feb 6, 2018 | 9.8 | 28 | NO | NO |
CVE-2016-3952HIGH web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. | Feb 6, 2018 | 7.8 | 23 | NO | NO |
CVE-2016-3954MEDIUM web2py before 2.14.2 allows remote attackers to obtain the session_cookie_key value via a direct request to examples/simple_examples/status. NOTE: this issue can be leveraged by r | Feb 6, 2018 | 5.5 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
7.7% of CVEs· 97th percentile
ExploitDB
3 CVEs
23.1% of CVEs· 90th percentile
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Web2py
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2.9.11 | 1 | 6.1 | 1.0% | 0 | 0 |
| 2.1.0 | 1 | 4.3 | 1.2% | 0 | 0 |
| 2.0.1-11 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.99.7 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.99.5 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.99.4 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.99.3 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.99.2 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.99.1 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.98.2 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.98.1 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.97.1 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.96.4 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.96.2 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.96.1 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.95.1 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.94.6 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.94.5 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.94.4 | 1 | 4.3 | 1.2% | 0 | 0 |
| 1.94.3 | 1 | 4.3 | 1.2% | 0 | 0 |