CVE-2025-55156— PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Quick assessment
Affected
pyload pyload
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
pyLoad是pyLoad开源的一个用 Python 编写的免费开源下载管理器。 pyLoad 0.5.0b3.dev91之前版本存在SQL注入漏洞，该漏洞源于API参数add_links未充分过滤，可能导致SQL注入攻击。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-55156
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter
Source: CVE Program / CVE List V5
Vulnerability Description
pyLoad is the free and open-source Download Manager written in pure Python. Prior to version 0.5.0b3.dev91, the parameter add_links in API /json/add_package is vulnerable to SQL Injection. Attackers can modify or delete data in the database, causing data errors or loss. This issue has been patched in version 0.5.0b3.dev91.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
pyLoad SQL注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
pyLoad是pyLoad开源的一个用 Python 编写的免费开源下载管理器。 pyLoad 0.5.0b3.dev91之前版本存在SQL注入漏洞，该漏洞源于API参数add_links未充分过滤，可能导致SQL注入攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-55156
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-55156
请登录查看更多情报信息。
Vendor Advisories for CVE-2025-55156 (1)
IV. Related Vulnerabilities
Same product: pyload
-
CVE-2026-45306
pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder By -
CVE-2026-45348
pyLoad: Stored XSS in Downloads view via unsanitized link UR -
CVE-2026-46561
pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API -
CVE-2026-44226
pyLoad: Unauthenticated traceback disclosure via global exce -
CVE-2026-42315
pyLoad: Path Traversal via Package Folder Name in set_packag
Same vendor: pyload
-
CVE-2026-45306
pyLoad: Incomplete Fix for CVE-2026-33509 -storage_folder By -
CVE-2026-45348
pyLoad: Stored XSS in Downloads view via unsanitized link UR -
CVE-2026-46561
pyLoad: SSRF via HTTP Redirect Bypass in parse_urls API -
CVE-2026-44226
pyLoad: Unauthenticated traceback disclosure via global exce -
CVE-2026-42315
pyLoad: Path Traversal via Package Folder Name in set_packag
Same weakness: CWE-89
-
CVE-2026-78656
itsourcecode Sales and Inventory System cust_del.php sql inj -
CVE-2026-78470
WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+ -
CVE-2026-15023
Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL I -
CVE-2026-32555
WordPress Boost plugin <= 2.0.4 - SQL Injection vulnerabilit -
CVE-2026-32554
WordPress WooBeWoo Product Filter Pro plugin <= 3.1.8 - SQL
V. Comments for CVE-2025-55156
No comments yet