CVE-2016-3952

web2py before 2.14.1, when using the standalone version, allows remote attackers to obtain environment variable values via a direct request to examples/template_examples/beautify. NOTE: this issue can be leveraged by remote attackers to gain administrative access.

• CWE-255

• https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/Exploit, Technical Description, Third Party Advisory
• https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40Third Party Advisory
• https://usn.ubuntu.com/4030-1/
• https://devco.re/blog/2017/01/03/web2py-unserialize-code-execution-CVE-2016-3957/Exploit, Technical Description, Third Party Advisory
• https://github.com/web2py/web2py/commit/9706d125b42481178d2b423de245f5d2faadbf40Third Party Advisory
• https://usn.ubuntu.com/4030-1/

Published

Feb 6, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-3946SAP Console (aka SAPConsole) 7.30 allows local users to disc…
• CVE-2016-3947Heap-based buffer overflow in the Icmp6::Recv function in ic…
• CVE-2016-3948Squid 3.x before 3.5.16 and 4.x before 4.0.8 improperly perf…
• CVE-2016-3949Siemens SIMATIC S7-300 Profinet-enabled CPU devices with fir…
• CVE-2016-3950Huawei AR3200 routers with software before V200R006C10SPC300…
• CVE-2016-3951Double free vulnerability in drivers/net/usb/cdc_ncm.c in th…
• CVE-2016-3953The sample web application in web2py before 2.14.2 might all…
• CVE-2016-3954web2py before 2.14.2 allows remote attackers to obtain the s…
• CVE-2016-3955The usbip_recv_xbuff function in drivers/usb/usbip/usbip_com…9.8
• CVE-2016-3956The CLI in npm before 2.15.1 and 3.x before 3.8.3, as used i…7.5
• CVE-2016-3957The secure_load function in gluon/utils.py in web2py before …
• CVE-2016-3958Untrusted search path vulnerability in Go before 1.5.4 and 1…7.8