CVE-2023-45158 (published 2023-10-16T07:53:52.134Z)
An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging (not the default configuration), a crafted web request may execute an arbitrary OS command on the web server using the product.
Affected products: Vendor: web2py
Product: web2py
Versions: 2.24.1 and earlier