CVE-2023-0434Medium· 5.4▾ SunlitImproper Input Validation in pyload-ng
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.8%
0.8% → 0.8%
Improper Input Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev40.
pyload-ng < 0.5.0b3.dev40Upgrade to a patched release:
pyload-ng 0.5.0b3.dev40Connected by shared product, vendor, weakness, or advisory.
CVE-2024-22416Critical· 9.6Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
CVE-2025-54802Critical· 9.8pyLoad CNL Blueprint allows Path Traversal through `dlc_path` which leads to Remote Code Execution (RCE)
CVE-2026-45306Medium· 6.5pyLoad Has Incomplete Fix for CVE-2026-33509 -storage_folder Bypass via Session Directory in pyLoad
CVE-2026-35463High· 8.8pyLoad: Improper Neutralization of Special Elements used in an OS Command
CVE-2026-40071Medium· 5.4pyload-ng has a WebUI JSON permission mismatch that lets ADD/DELETE users invoke MODIFY-only actions
CVE-2026-45348High· 8.7pyLoad is vulnerable to stored XSS in Downloads view via unsanitized link URL in packages.js template literal