34 matches found
Cross-site Scripting (XSS)
flask-admin is vulnerable to cross-site scripting XSS attacks. The library does not properly handle whitespace, allowing a malicious user to inject and execute arbitrary Javascript by using the %20 character in a url...
CVE-2018-16516
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
CVE-2018-16516
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
Cross site scripting
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
PYSEC-2018-54
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)
flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: OSV:PYSEC-2018-54...
PYSEC-2018-54
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
CVE-2018-16516
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
CVE-2018-16516
CVE-2018-16516 affects Flask-Admin up to version 1.5.2, where helpers.py is vulnerable to reflected XSS via a crafted URL. The root cause is improper escaping that allows attacker-supplied input to be reflected in the response. Exploitation details are not provided in the documents beyond this de...
alo7-airflow (>=1.10.0, <=1.10.0.7), autologin (>=0.1.1, <=0.1.3) +3 more potentially affected by CVE-2018-16516 via flask-admin (>=1.4.0, <=1.5.2)
flask-admin PYPI version =1.4.0, =1.10.0, =0.1.1, =0.6.7.post3, =4.2.6, =0.1.0, =0.2.0 Source cves: CVE-2018-16516 Source advisory: MEND:CVE-2018-16516...
CVE-2018-16516
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
CVE-2018-16516: Improper Neutralization of Input During Web Page Generation
helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...
PT-2018-13605
Name of the Vulnerable Software and Affected Versions Flask-Admin version 1.5.2 Description The issue is related to Reflected XSS, which can be triggered via a crafted URL. This allows an attacker to inject malicious code into a user's browser. Recommendations For Flask-Admin version 1.5.2, updat...