Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-mbkb-u95k-yfgc
Vulnerability ID VCID-mbkb-u95k-yfgc
Aliases CVE-2025-55156
GHSA-pwh4-6r3m-j2rf
Summary PyLoad vulnerable to SQL Injection via API /json/add_package in add_links parameter The parameter `add_links` in the API /json/add_package is vulnerable to SQL Injection. SQL injection vulnerabilities can lead to sensitive data leakage.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2025-55156
epss 0.00058 https://api.first.org/data/v1/epss?cve=CVE-2025-55156
cvssv4 7.8 https://github.com/pyload/pyload
generic_textual HIGH https://github.com/pyload/pyload
cvssv4 7.8 https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
generic_textual HIGH https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
ssvc Track* https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
cvssv4 7.8 https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
generic_textual HIGH https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
ssvc Track* https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
cvssv4 7.8 https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
generic_textual HIGH https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
ssvc Track* https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
cvssv4 7.8 https://nvd.nist.gov/vuln/detail/CVE-2025-55156
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2025-55156
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-55156
https://github.com/pyload/pyload
https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
CVE-2025-55156 https://nvd.nist.gov/vuln/detail/CVE-2025-55156
GHSA-pwh4-6r3m-j2rf https://github.com/advisories/GHSA-pwh4-6r3m-j2rf
GHSA-pwh4-6r3m-j2rf https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/pyload/pyload
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-08-12T15:49:23Z/ Found at https://github.com/pyload/pyload/blob/develop/src/pyload/core/database/file_database.py#L271
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-08-12T15:49:23Z/ Found at https://github.com/pyload/pyload/commit/134edcdf6e2a10c393743c254da3d9d90b74258f
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-08-12T15:49:23Z/ Found at https://github.com/pyload/pyload/security/advisories/GHSA-pwh4-6r3m-j2rf
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P Found at https://nvd.nist.gov/vuln/detail/CVE-2025-55156
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.18553
EPSS Score 0.00058
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T16:24:36.190326+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/pyload-ng/CVE-2025-55156.yml 38.6.0