CVE-2024-24808

pyLoad is an open-source Download Manager written in pure Python. There is an open redirect vulnerability due to incorrect validation of input values when redirecting users after login. pyLoad is validating URLs via the `get_redirect_url` function when redirecting users at login. This vulnerability has been patched with commit fe94451.

• CWE-601

• https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccdPatch
• https://github.com/pyload/pyload/security/advisories/GHSA-g3cm-qg2v-2hj5Exploit, Vendor Advisory
• https://github.com/pyload/pyload/commit/fe94451dcc2be90b3889e2fd9d07b483c8a6dccdPatch
• https://github.com/pyload/pyload/security/advisories/GHSA-g3cm-qg2v-2hj5Exploit, Vendor Advisory

Published

Feb 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-24802Cross-Site Request Forgery (CSRF) vulnerability in John Tend…8.8
• CVE-2024-24803Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-24804Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2024-24805Missing Authorization vulnerability in Deepak anand WP Dummy…5.3
• CVE-2024-24806libuv is a multi-platform support library with a focus on as…7.3
• CVE-2024-24807Sulu is a highly extensible open-source PHP content manageme…4.8
• CVE-2024-24809Traccar is an open source GPS tracking system. Versions prio…8.5
• CVE-2024-2481A vulnerability, which was classified as critical, was found…6.5
• CVE-2024-24810WiX toolset lets developers create installers for Windows In…7.8
• CVE-2024-24811SQLAlchemyDA is a generic database adapter for ZSQL methods.…9.8
• CVE-2024-24812Frappe is a full-stack web application framework that uses P…5.4
• CVE-2024-24813Frappe is a full-stack web application framework. Prior to v…7.5