4069 matches found
CVE-2026-1827: Improper Neutralization of Input During Web Page Generation
The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
PT-2026-7503
The Flask Micro code-editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's codeflask shortcode in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...
flask-adfs (>=0.0.1, <=0.1.8) potentially affected by CVE-2026-26007 via cryptography (1.5.1)
cryptography PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - flask-adfs =0.0.1, =0.1.8 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...
flask-adfs (>=0.0.1, <=0.1.8) potentially affected by CVE-2026-26007 via cryptography (1.5.1)
cryptography PYPI version 1.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - flask-adfs =0.0.1, =0.1.8 Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...
Exploit for Deserialization of Untrusted Data in Bentoml
CVE-2025-27520 — Безопасная учебная симуляция / PoC Demo Stan...
📄 Flask-Uploads 0.2.1 Path Traversal / Arbitrary File Write
Flask-Uploads versions 0.2.1 and below Metasploit module that exploits a path traversal vulnerability to achieve an arbitrary file write. ============================================================================================================================================= | Title :...
my-flask (2023.4.23), zonesmart-utils (>=0.4.0, <=0.4.1) potentially affected by CVE-2026-1703 via pip (23.0.0)
pip PYPI version 23.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - my-flask 2023.4.23 - zonesmart-utils =0.4.0, =0.4.1 Source cves: CVE-2026-1703 Source advisory: OSV:GHSA-6VGW-5PG2-W6JP...
Active Debug Code
Overview dfir-unfurl is an Unfurl takes a URL and expands "unfurls" it into a directed graph Affected versions of this package are vulnerable to Active Debug Code due to improper parsing of the debug configuration value, which is always interpreted as truthy and enables the Werkzeug debugger...
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:weba...
GHSA-VG9H-JX4V-CWX2 Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:weba...
PT-2026-31470
Name of the Vulnerable Software and Affected Versions Unfurl versions through 2025.08 Description Unfurl through 2025.08 has an improper input validation issue in config parsing that enables Flask debug mode by default. The debug configuration value is read as a string and passed directly to...
PT-2026-7000
Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:web...
SQLi
SQL Injection CTF Challenge - Quick Start Guide Files Over...
Malicious code in flask-hookserver (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 4d5afd1538994efa55632d3ed6d7c9fa419fb26c542b641a3efbd7b35501ea58 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
EUVD-2026-4644
Malicious code in flask-hookserver PyPI...
CVE-2026-Pending-Flask-Uploads-Path-Traversal-PoC
CVE-2026-XXXXX Pending: Path Traversal in Flask-Uploads...
FlaskRCE
FlaskRCE PoC --- Technical Write‑Up Repository: https://g...
MiracleLinux 7 : python-flask-0.10.1-7.el7 (AXSA:2023-5938:01)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2023-5938:01 advisory. flask: Possible disclosure of permanent session cookie due to missing Vary: Cookie header CVE-2023-30861 Tenable has extracted the preceding description bloc...
MiracleLinux 7 : python-flask-0.10.1-5.el7 (AXSA:2020-4499:01)
The remote MiracleLinux 7 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2020-4499:01 advisory. python-flask: Denial of Service via crafted JSON file CVE-2018-1000656 Tenable has extracted the preceding description block directly from the MiracleLinux...