CVE-2025-55737mediumCWE-639

CVE-2025-55737: falha de média gravidade em DogukanUrker FlaskBlog

flaskBlog arbitrary comment delete

Publicada em

Seguir esta CVE+ Monitorar FlaskBlog

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.9epss 0.3%
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
DogukanUrker · FlaskBlog
CVEs relacionadas — DogukanUrker FlaskBlog

No mesmo produto, das mais perigosas para as menos.

CVE-2025-55734MEDIUMflaskBlo Authorization BypassEPSS 0.4%CVE-2025-55736CRITICALflaskBlog allows arbitrary privilege escalationEPSS 0.3%CVE-2025-55735MEDIUMflaskBlog Stored XSS VulnerabilityEPSS 0.2%