TI-2016-04152 Aliases CVE-2016-4807 GHSA-pvcp-73cg-6f77

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which…

LOW 26CWE-79Published 2017-01-11 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin).

Why it matters now

EPSS 0.02299 83rd percentileScored 2026-11-07

Public exploit Yes 2 exploit referencesTagged by the CNA and NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	web2py (PyPI)	up to 2.14.5	—	No fix listed	GHSA-pvcp-73cg-6f77

— Vendor— Affected all versions Fixed in — No fix listed CNA
web2py (PyPI) Vendor— Affected up to 2.14.5 Fixed in — No fix listed GHSA-pvcp-73cg-6f77

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:web2py:web2py::::::::	up to 2.14.5	Vulnerable	web2py

cpe:2.3:a:web2py:web2py:*:*:*:*:*:*:*:* Versions up to 2.14.5 Vulnerable ·web2py

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2016-4807
2026-10-03 Alias added: GHSA-pvcp-73cg-6f77

References

Exploit 2

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2016-4807

Other 2

TI-2023-24174 OS command injection in web2py CVSS 3.1CRITICAL 9.8
TI-2016-03363 The secure_load function in gluon/utils.py in web2py before 2.14.2 uses pickle.loads to… CVSS 3.0CRITICAL 9.8
TI-2016-03359 The sample web application in web2py before 2.14.2 might allow remote attackers to… CVSS 3.0CRITICAL 9.8
TI-2016-08383 web2py before 2.14.6 does not properly check if a host is denied before verifying… CVSS 3.0CRITICAL 9.8
TI-2016-04151 Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability… CVSS 3.0HIGH 7.5
TI-2016-04153 Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery)… CVSS 3.0HIGH 8.8

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences