PT-2025-37255

Name of the Vulnerable Software and Affected Versions: Flask-AppBuilder versions prior to 4.8.1 Description: Flask-AppBuilder is an application development framework. When configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains accessible...

Flask App Builder 授权问题漏洞

Flask App Builder is a simple and fast application development framework by Daniel Vaz Gaspar Personal Developer. An authorization issue vulnerability exists in Flask App Builder versions prior to 4.8.1, which stems from not disabling the password reset feature when using a non-database...

Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods

When Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface. This allows an enabled user to reset their password and be able to create JWT...

CVE-2025-58065: Improper Authentication

Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication methods, the password reset endpoint remains registered and accessible, despite not being displayed in the user interface...

CVE-2025-59034

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-59034

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

CVE-2025-59035: Improper Neutralization of Input During Web Page Generation

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, there is a Cross-Site-Scripting vulnerability when rendering LaTeX math code in contribution or abstract descriptions. Users should to update to Indico 3.3.8 as...

CVE-2025-59034: Authorization Bypass Through User-Controlled Key

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to version 3.3.8, a legacy API to retrieve user details could be misused to retrieve profile details of other users without having admin permissions due to a broken access check...

Linux Distros Unpatched Vulnerability : CVE-2021-32618

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Python Flask-Security-Too package is used for adding security features to your Flask application. It is an is an independently maintained version of...

Vulnerability-identification-and-Mitigation

It is an offensive tool for source code and SMS message analysis...

[SECURITY] Fedora 42 Update: python-flask-3.1.2-2.fc42

Flask is called a =E2=80=9Cmicro-framework=E2=80=9D because the idea to keep the core simple but extensible. There is no database abstraction layer, no form validation or anything else where different libraries already exist that can handle that. However Flask knows the concept of extensions that...

PT-2025-36965

Name of the Vulnerable Software and Affected Versions: FTP-Flask-python versions through 5173b68 Description: A command injection issue exists in FTP-Flask-python. The /ftp.html endpoint’s "Upload File" action constructs a shell command from the ftp file parameter and executes it using os.system...

FTP-Flask-python 安全漏洞

FTP-Flask-python is a Python library by the individual developer Ajay Pandurang Paratmandali. A security vulnerability exists in FTP-Flask-python 5173b68 and earlier versions, which stems from an uncleaned and escaped ftpfile parameter that could lead to remote command execution...

CVE-2025-57633

A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html endpoint's "Upload File" action constructs a shell command from the ftpfile parameter and executes it using os.system without sanitization ...

Fedora 42 : python-flask (2025-55e69c9cea)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-55e69c9cea advisory. - Update to 3.1.2 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Fedora: Security Advisory (FEDORA-2025-55e69c9cea)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-57633: Improper Neutralization of Special Elements used in a Command

A command injection vulnerability in FTP-Flask-python through 5173b68 allows unauthenticated remote attackers to execute arbitrary OS commands. The /ftp.html endpoint's "Upload File" action constructs a shell command from the ftpfile parameter and executes it using os.system without sanitization ...

Web-Vulnerability-Scanner

This is a PoC exploit for a web vulnerability scanner created us...

VulnXploit

VulnScan Pro - Advanced Vulnerability Scanner A professional...

Cross-site Scripting (XSS)

Overview pywa is a 🚀 Build WhatsApp Bots in Python • Fast, Effortless, Powerful Affected versions of this package are vulnerable to Cross-site Scripting XSS via the webhook challenge and update handlers in the Flask and FastAPI webhook endpoints. An attacker can execute malicious scripts in...