CVE-2025-55156CWE-89

PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter

High · published August 11, 2025

CVSS v4.0
7.8
EPSS
0%
Percentile
26.4
In the wild
Unconfirmed
What it is

pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.

The record
Technical detail
CVSS v4.0
7.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00342 · 26.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-08-11T22:21Z
EPSS history
Timeline
  • 11 AUG 22:21Z
    PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
    cvelistv5