Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates/js/packages.js:172 interpolates a stored link URL into a template literal inside single-quoted HTML and then writes the result to the DOM via $(div).html(html). No escaping runs between the API value and innerHTML. An attacker (Alice) who can submit a package link puts a single quote plus event handler into the URL, breaks out of the attribute, and executes JavaScript in every operator's browser that opens the downloads view. The theme does not set a Content Security Policy that restricts inline script or event handlers. This vulnerability is fixed in 0.5.0b3.dev100.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-45348 Stored Cross-Site Scripting in pyLoad Prior to Version 0.5.0b3.dev100 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-45348
Post summary
The text references CVE-2026-45348, noting a stored XSS flaw in pyLoad versions earlier than 0.5.0b3.dev100, but it does not provide a PoC, exploit code, active exploitation evidence, patch, or false‑positive claim.
CVE-2026-45348 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates… https://www.cve.org/CVERecord?id=CVE-2026-45348
Post summary
The post simply references CVE‑2026‑45348 and provides a link to the CVE record, with no further actionable details.
🚨*CVE* CVE-2026-45348 pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev100, the packages.js template at src/pyload/webui/app/themes/modern/templates… https://www.cve.org/CVERecord?id=CVE-2026-45348 ----- Traducción: CVE-2026-45348 pyL… http://infoflow.cloud`
Post summary
The text announces CVE-2026-45348 for pyLoad but provides only a brief reference and the CVE record link, with no additional detail on the vulnerability, exploitation, or mitigation.