https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 23:45:15 +0000 https://cve.radiocsirt.org/vuln/cve-2025-55156 <p><strong>Affected:</strong> pyload</p> <p>pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.</p> <p><strong>Affected:</strong> pyload</p> <p>pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.</p> https://cve.radiocsirt.org/vuln/cve-2025-55156 https://cve.radiocsirt.org/vuln/ghsa-pwh4-6r3m-j2rf <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>### Summary The parameter `add_links` in the API /json/add_package is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage.</p> <p>### Details - Affected file：https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271 - Affected code: ```python @style.queue def update_link_info(self, data): &#34;&#34;&#34; data is list of tuples (name, size, status, url) &#34;&#34;&#34; self.c.executemany( &#34;UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)&#34;, data, ) ids = [] statuses = &#34;&#39;,&#39;&#34;.join(x[3] for x in data) self.c.execute(f&#34;SELECT id FROM links WHERE url IN (&#39;{statuses}&#39;)&#34;) for r in self.c: ids.append(int(r[0])) return ids ```` statuses is constructed from data, and data is the value of the add_links parameter entered by the user through /json/add_packge. Because `{statuses}` is directly spliced into the SQL statement, it leads to the SQL injection vulnerability.</p> <p>- Vulnerability Chain ```xml josn_blueprint.py#add_package src/pyload/core/api/__init__.py#add_package src/pyload/core/managers/file_manager.py#add_links src/pyload/core/threads/info_thread.py#run src/pyload/core/threads/info_thread.py#update_info src/pyload/core/managers/file_manager.py#update_file_info src/pyload/core/database/file_database.py#update_link_info ```</p> <p>### PoC ```python import requests</p> <p>if __name__ == &#34;__main__&#34;:…</p> <p><strong>Affected:</strong> PyPI: pyload-ng</p> <p>### Summary The parameter `add_links` in the API /json/add_package is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage.</p> <p>### Details - Affected file：https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271 - Affected code: ```python @style.queue def update_link_info(self, data): &#34;&#34;&#34; data is list of tuples (name, size, status, url) &#34;&#34;&#34; self.c.executemany( &#34;UPDATE links SET name=?, size=?, status=? WHERE url=? AND status IN (1,2,3,14)&#34;, data, ) ids = [] statuses = &#34;&#39;,&#39;&#34;.join(x[3] for x in data) self.c.execute(f&#34;SELECT id FROM links WHERE url IN (&#39;{statuses}&#39;)&#34;) for r in self.c: ids.append(int(r[0])) return ids ```` statuses is constructed from data, and data is the value of the add_links parameter entered by the user through /json/add_packge. Because `{statuses}` is directly spliced into the SQL statement, it leads to the SQL injection vulnerability.</p> <p>- Vulnerability Chain ```xml josn_blueprint.py#add_package src/pyload/core/api/__init__.py#add_package src/pyload/core/managers/file_manager.py#add_links src/pyload/core/threads/info_thread.py#run src/pyload/core/threads/info_thread.py#update_info src/pyload/core/managers/file_manager.py#update_file_info src/pyload/core/database/file_database.py#update_link_info ```</p> <p>### PoC ```python import requests</p> <p>if __name__ == &#34;__main__&#34;:…</p> https://cve.radiocsirt.org/vuln/ghsa-pwh4-6r3m-j2rf