Browse CVEs

MEDIUM 6.5 CVE-2025-55737 flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every… Flaskblog after 2.8.0 Fix from $1,6002025-08-19 MEDIUM 6.5 CVE-2025-55734 flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but no… Flaskblog after 2.8.0 Fix from $1,6002025-08-19 MEDIUM 6.5 CVE-2025-55736 flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g… Flaskblog after 2.8.0 Fix from $1,6002025-08-19 MEDIUM 5.4 CVE-2025-55735 flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the … Flaskblog after 2.8.0 Fix from $1,6002025-08-19 MEDIUM 5.4 CVE-2025-53631 flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createp… Flaskblog after 2.8.1 Fix from $1,6002025-08-14 CRITICAL 9.1 CVE-2025-28104 Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input. Flaskblog No fix yet Fix from $2,3002025-04-21 MEDIUM 6.4 CVE-2025-28103 Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request. Flaskblog Mitigation only Fix from $1,6002025-04-21 MEDIUM 6.1 CVE-2025-28102 A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… Flaskblog No fix yet Fix from $1,6002025-04-21 MEDIUM 6.5 CVE-2025-28101 An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by … Flaskblog No fix yet Fix from $1,6002025-04-17 MEDIUM 5.4 CVE-2024-22414 flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitr… Flaskblog after 1.1.0 Fix from $1,6002024-01-17