Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
10 results
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55737 · Other software · DogukanUrker · reported by GitHubMedium 6.9
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55736 · Other software · DogukanUrker · reported by GitHubCritical 9.3
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55735 · Other software · DogukanUrker · reported by GitHubMedium 5.3
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filter, that tells the engine to not escape the rendered content. This can lead to a stored XSS inside the content of the post. The code that causes the problem is in template/routes.html.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 19, 2025flaskBlog is a blog app built with Flask.CVE-2025-55734 · Other software · DogukanUrker · reported by GitHubMedium 6.9
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a user is trying to access the admin page, but that control is not done for the pages routes/adminPanelComments.py and routes/adminPanelPosts.py. Thus, an unauthorized user can bypass the intended restrictions, leaking sensitive data and accessing the following pages: /admin/posts, /adminpanel/posts, /admin/comments, and /adminpanel/comments.
- Product
- FlaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 14, 2025flaskBlog is a blog app built with Flask.CVE-2025-53631 · Other software · DogukanUrker · reported by GitHubMedium 5.3
flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID], /admin/posts, and /user/[ID] of the user that made the post. At time of publication, there are no public patches available.
- Product
- flaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 21, 2025Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.CVE-2025-28104 · Other software · Dogukanurker · reported by MITRECritical 9.1
Incorrect access control in laskBlog v2.6.1 allows attackers to access all usernames via a crafted input.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2025Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request.CVE-2025-28103 · Other software · Dogukanurker · reported by MITREMedium 6.4
Incorrect access control in laskBlog v2.6.1 allows attackers to arbitrarily delete user accounts via a crafted request.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 21, 2025A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into theCVE-2025-28102 · Other software · Dogukanurker · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Apr 17, 2025An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other usersCVE-2025-28101 · Other software · Dogukanurker · reported by MITREMedium 6.5
An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other users via supplying a crafted POST request.
- Product
- Flaskblog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Jan 17, 2024flaskBlog is a simple blog app built with Flask.CVE-2024-22414 · Other software · DogukanUrker · reported by GitHubMedium 6.5
flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javascript code. The html template `user.html` contains the following code snippet to render comments made by a user: `<div class="content" tag="content">{{comment[2]|safe}}</div>`. Use of the "safe" tag causes flask to _not_ escape the rendered content. To remediate this, simply remove the `|safe` tag from the HTML above. No fix is is available and users are advised to manually edit their installation.
- Product
- flaskBlog
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.