A cross-site scripting (XSS) vulnerability in pyLoad allows attackers to execute malicious scripts within a user's browser, potentially leading to full account compromise.

This is a Cross-Site Scripting (XSS) vulnerability (CWE-79) occurring during web page generation. It allows an attacker with low privileges to inject malicious scripts that execute in the context of the user's browser session.

The CVSS score of 8.7 reflects the high potential for session hijacking and unauthorized administrative action. By exploiting this XSS vulnerability, an attacker can steal session cookies, perform actions on behalf of the user, or redirect users to malicious sites, severely compromising the security of the pyLoad installation.

Immediate Action: Update the pyLoad installation to version 0.5.0b3.dev100 or later immediately.

Proactive Monitoring: Monitor web traffic logs for signs of script injection attempts and review user session activity for anomalies.

Compensating Controls: Implement a strong Content Security Policy (CSP) to restrict the execution of unauthorized scripts within the browser environment.

Public Exploit Available: Unknown

Users of the pyLoad download manager should upgrade to the latest version immediately to patch this XSS vulnerability. Failure to do so leaves the application susceptible to session-based attacks that could lead to complete unauthorized control of the software.