CVE-2026-25198

MediumCVSS 5.1/10Last modified Jun 17, 2026

Description

web2py versions 2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior contain an open redirect vulnerability. If this vulnerability is exploited, the user may be redirected to an arbitrary website when accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

Metrics

CVSS 4.0 5.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
web2py	web2py	2.27.1-stable+timestamp.2023.11.16.08.03.57 and prior

References

Timeline

Published: Feb 5, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-251999.1Instances deployed via the Proxmox extension allow unauthorized access to instances belonging to other tenants. This issue affects Apach CVE-2026-25205.4The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to CVE-2026-252009.8A vulnerability in MagicInfo9 Server allows authorized users to upload HTML files without authentication, leading to Stored XSS, which can r CVE-2026-252018.8An unauthenticated user can upload arbitrary files to execute remote code, leading to privilege escalation in MagicInfo9 Server. This issue CVE-2026-252029.8The database account and password are hardcoded, allowing login with the account to manipulate the database in MagicInfo9 Server.This issue CVE-2026-252037.8Samsung MagicINFO 9 Server Incorrect Default Permissions Local Privilege Escalation Vulnerability This issue affects MagicINFO 9 Server: l CVE-2026-252047.5Deserialization of untrusted data vulnerability in Samsung Open Source Escargot Java Script allows denial of service condition via process a CVE-2026-252059.8Heap-based buffer overflow vulnerability in Samsung Open Source Escargot allows out-of-bounds write.This issue affects Escargot:commit hash CVE-2026-252069.1Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc5 CVE-2026-252079.8Out-of-bounds write vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b CVE-2026-252089.8Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4 CVE-2026-252099.1Out-of-bounds read vulnerability in Samsung Open Source Escargot allows Resource Leak Exposure.This issue affects Escargot: 97e8115ab1110bc5