Created
April 16, 2025 03:59
-
-
Save coleak2021/edbd6e0766227ee96a7a4601e50773eb to your computer and use it in GitHub Desktop.
cve - 2025 - 28102
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [CVE-ID] | |
| CVE-2025-28102 | |
| [PRODUCT] | |
| flaskBlog - v2.6.1 | |
| [TYPE] | |
| Cross Site Scripting (XSS) | |
| [Affected Component] | |
| postContent, postTags, postTitle | |
| [DESCRIPTION] | |
| A cross-site scripting (XSS) vulnerability in flaskBlog v2.6.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the postContent parameter at /createpost. | |
| [Mitigation & Fix Recommendations] | |
| Use autoescape to escape the rendered content. | |
| [MORE] | |
| https://github.com/DogukanUrker/flaskBlog/issues/130 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment