CVE-2023-0055Medium· 5.3▾ SunlitPyload contains Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
0.4% → 0.4%
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository pyload/pyload prior to 0.5.0b3.dev32. The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session. This issue is patched in version 0.5.0b3.dev32.
pyload-ng < 0.5.0b3.dev32Upgrade to a patched release:
pyload-ng 0.5.0b3.dev32Connected by shared product, vendor, weakness, or advisory.
CVE-2024-22416Critical· 9.6Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
CVE-2025-54802Critical· 9.8pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
CVE-2026-45306Medium· 6.5pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
CVE-2026-35463High· 8.8pyLoad: Improper Neutralization of Special Elements used in an OS Command
CVE-2026-40071Medium· 5.4pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
CVE-2026-45348High· 8.7pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal