CVE-2016-4808
HighSummary
Web2py versions 2.14.5 and below are affected by a CSRF (Cross Site Request Forgery) vulnerability, allowing an attacker to trick a logged-in user into performing unwanted actions. An attacker can deceive a victim into disabling the installed application simply by sending a URL.
Risk Assessment
This vulnerability could lead to unauthorized application shutdowns by logged-in users, potentially disrupting system operations and impacting data security.
Recommendation
It is recommended to upgrade Web2py to a version above 2.14.5 and implement additional protections against CSRF attacks.
Other vulnerabilities in Web2py
See all- CVE-2016-4806High
Web2py versions 2.14.5 and below is affected by a Local File Inclusion vulnerability, allowing a malicious user to access sensitive web server files.
- CVE-2016-10321Critical
Web2py versions before 2.14.6 do not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks.
- CVE-2026-79318Medium
web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (applications/admin/controllers/webservices.py).
Original NVD description (English source)
Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform some unwanted actions i.e An attacker can trick an victim to disable the installed application just by sending a URL to victim.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS