CVE-2025-55737mediumCWE-639

CVE-2025-55737: fallo de gravedad media en DogukanUrker FlaskBlog

flaskBlog arbitrary comment delete

Publicada el

Seguir esta CVE+ Monitorear FlaskBlog

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.9epss 0.3%
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
DogukanUrker · FlaskBlog
CVEs relacionadas — DogukanUrker FlaskBlog

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-55734MEDIUMflaskBlo Authorization BypassEPSS 0.4%CVE-2025-55736CRITICALflaskBlog allows arbitrary privilege escalationEPSS 0.3%CVE-2025-55735MEDIUMflaskBlog Stored XSS VulnerabilityEPSS 0.2%