webpy web.py 0.76 is vulnerable to Session Fixation. The component Session.load() reads sessionid directly from the request cookie and loads that session from the store, and save() writes back under the same sessionid; no rotation after authentication, so a fixed sessionid keeps the authenticated state.

A vulnerability, which was classified as critical, was found in webpy web.py 0.70. Affected is the function PostgresDB.processinsertquery of the file web/db.py. The manipulation of the argument seqname leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via renderjinja.init().