CVE-2025-62379

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

CVE-2025-62379 Open Redirect in reflex-dev/reflex

Reflex is a library to build full-stack web apps in pure Python. In versions 0.5.4 through 0.8.14, the /auth-codespace endpoint automatically assigns the redirectto query parameter value directly to client-side links without any validation and triggers automatic clicks when the page loads in a...

CVE-2025-62379

Reflex (Python web app framework) versions 0.5.4–0.8.14 contain an Open Redirect in the /auth-codespace route: the redirect_to query parameter is assigned directly to client-side links without validation, triggering automatic navigation, which can redirect users to arbitrary external URLs. The vu...

Reflex 输入验证错误漏洞

Reflex is a web application from the Reflex open source. An input validation error vulnerability exists in Reflex versions 0.5.4 through 0.8.14, which stems from an unvalidated redirectto query parameter value that could cause a user to be redirected to an arbitrary external URL...

CVE-2025-62379

creationtimestamp| type| source ---|---|--- 2025-10-14 23:48:41+00:00| published-proof-of-concept| https://github.com/reflex-dev/reflex/security/advisories/GHSA-rfh5-c9h5-q8jm...

GHSA-G8C6-8FJJ-2R4M vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

CVE-2025-61765 vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

GHSA-G8C6-8FJJ-2R4M vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

CVE-2025-61765 vulnerabilities

Vulnerabilities for packages: open-webui, reflex...

EUVD-2013-7240

Malware in sbrugna...

EUVD-2024-0913

Malicious code in bioql PyPI...

CVE-2021-35953

fastrack Reflex 2.0 W307SREFLEXv90.89 Activity Tracker allows a Remote attacker to cause a Denial of Service device outage via crafted choices of the last three bytes of a characteristic value...

CVE-2013-7482

The reflex-gallery plugin before 1.4.3 for WordPress has XSS...

CVE-2025-47425 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-RF8X-9MHR-49WG vulnerabilities

Vulnerabilities for packages: reflex...

CVE-2025-47425 vulnerabilities

Vulnerabilities for packages: reflex...

GHSA-RF8X-9MHR-49WG vulnerabilities

Vulnerabilities for packages: reflex...

Access Control Bypass

Overview reflex is a Web apps in pure Python. Affected versions of this package are vulnerable to Access Control Bypass through the event handling mechanism. An attacker can impersonate other users or gain unauthorized administrative access by manipulating state fields that are not intended to be...