Cross site scripting

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

PYSEC-2018-54

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL...

CVE-2018-16516

CVE-2018-16516 affects Flask-Admin up to version 1.5.2, where helpers.py is vulnerable to reflected XSS via a crafted URL. The root cause is improper escaping that allows attacker-supplied input to be reflected in the response. Exploitation details are not provided in the documents beyond this de...

Cross-Site Scripting (XSS)

flask-admin is vulnerable to cross-site scripting XSS attacks. This is because it does not escape html in columneditablelist values...