{"id":"CVE-2016-4807","aliases":["GHSA-pvcp-73cg-6f77","PYSEC-2026-1063"],"title":"Web2py Reflected XSS vulnerability","summary":"Web2py Reflected XSS vulnerability","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","vendor":"web2py","product":"web2py","ecosystem":"pip","affected":["web2py <= 2.14.5"],"published":"2022-05-17","updated":"2026-07-07","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-pvcp-73cg-6f77","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-4807"},{"url":"https://github.com/web2py/web2py"},{"url":"https://www.exploit-db.com/exploits/39821"},{"url":"http://packetstormsecurity.com/files/137070/Web2py-2.14.5-CSRF-XSS-Local-File-Inclusion.html"}],"tags":["osv","pip","exploit-available"],"epss":0.02943,"epssPercentile":0.86478,"exploitAvailable":true,"ingestedAt":"2026-07-08T18:25:52.013Z","exploits":{"exploitdb":true,"checkedAt":"2026-09-21T15:24:38.690Z"},"slug":"CVE-2016-4807","body":"## Overview\n\nWeb2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).\n\n## Affected packages\n\n- `web2py <= 2.14.5`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":26.4,"likelihood":0.6,"exploitation":12,"ransomware":0},"changes":[]}