CVSS 4.0
7.8 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:PCVE-2025-55156
High (7.8). EPSS 0.3% chance of exploitation in the next 30 days. Fixed in pyload-ng 0.5.0b3.dev91.
pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
Severity
- EPSS
- 0.3% chance of exploitation in the next 30 days; higher than 27% of CVEs (scores of 2026-10-31)
- CWE
- CWE-89
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-pwh4-6r3m-j2rf | PyPI | pyload-ng | <0.5.0b3.dev91 | 0.5.0b3.dev91 |
| PYSEC-2026-1821 | PyPI | pyload-ng | <0.5.0b3.dev91 | 0.5.0b3.dev91 |