CVE-2025-28101

An arbitrary file deletion vulnerability in the /post/postTitle component of flaskBlog v2.6.1 allows attackers to delete article titles created by other users via supplying a crafted POST request...

FlaskBlog Security Vulnerabilities

FlaskBlog is a simple blogging application built using Flask by Doğukan Ürker Personal Developer. A security vulnerability exists in FlaskBlog version 2.6.1, which stems from mishandling of the /post/postTitle component and could lead to arbitrary file deletion...

PT-2025-17223 · Flaskblog · Flaskblog

Name of the Vulnerable Software and Affected Versions: flaskBlog version 2.6.1 Description: The issue allows attackers to delete article titles created by other users by supplying a crafted POST request to the "/post/postTitle" component. Recommendations: For flaskBlog version 2.6.1, consider...

CVE-2025-28101

The flaskBlog application, version 2.6.1 , is affected by an arbitrary file deletion vulnerability in its /post/{postTitle} component. Attackers can exploit this by supplying a crafted POST request to delete article titles created by other users. As a temporary workaround, it is recommended to re...

CVE-2024-22414

flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe. Use of the "safe" tag...

CVE-2024-22414 User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog

flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe. Use of the "safe" tag...

CVE-2024-22414

CVE-2024-22414 affects the FlaskBlog app. The root cause is improper storage/rendering on the /user/ page due to using the template snippet {{comment[2]|safe}}, which disables HTML escaping via the safe filter. As a result, user comments can render arbitrary JavaScript, enabling XSS. A remediatio...

CVE-2024-22414: Improper Neutralization of Input During Web Page Generation

flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the /user/ page allows a user's comments to execute arbitrary javascript code. The html template user.html contains the following code snippet to render comments made by a user: comment2|safe . Use of the "safe" ta...

PT-2024-19405 · Flaskblog · Flaskblog

Name of the Vulnerable Software and Affected Versions: flaskBlog affected versions not specified Description: The issue is related to improper storage and rendering of user comments on the /user/ page, allowing arbitrary javascript code execution. This is due to the use of the |safe tag in the...

FlaskBlog Cross-Site Scripting Vulnerability

FlaskBlog is a simple blog application built using Flask. FlaskBlog suffers from a cross-site scripting vulnerability that stems from improper storage and rendering of pages, allowing an attacker to execute arbitrary JavaScript code...