Skip to content
OpenAdvisories

Vendor

DogukanUrker

6 known vulnerabilities.

DogukanUrker at a glance

Last 12 months
0
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202551
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

flaskBlog 6
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Medium 6.9
    CVE-2025-55737

    flaskBlog arbitrary comment delete

    flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request…

    DogukanUrker flaskBlog
  • Critical 9.3
    CVE-2025-55736

    flaskBlog allows arbitrary privilege escalation

    flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, an arbitrary user can change his role to "admin", giving its relative privileges (e.g. delete users, posts, comments etc.). The problem is in the routes/adminPanelUsers file.

    DogukanUrker flaskBlog
  • Medium 5.3
    CVE-2025-55735

    flaskBlog Stored XSS Vulnerability

    flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when creating a post, there's no validation of the content of the post stored in the variable "postContent". The vulnerability arises when displaying the content of the post using the | safe filt…

    DogukanUrker flaskBlog
  • Medium 6.9
    CVE-2025-55734

    flaskBlo Authorization Bypass

    flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when visiting its subroutes. Specifically, only the file routes/adminPanel.py checks the user role when a us…

    DogukanUrker flaskBlog
  • Medium 5.3
    CVE-2025-53631

    flaskBlog XSS Vulnerability in postContent

    flaskBlog is a blog app built with Flask. In versions 2.8.1 and prior, improper sanitization of postContent when submitting POST requests to /createpost leads to arbitrary JavaScript execution (XSS) on all pages the post is reflected on including /, /post/[ID…

    DogukanUrker flaskBlog
  • Medium 6.5
    CVE-2024-22414

    User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog

    flaskBlog is a simple blog app built with Flask. Improper storage and rendering of the `/user/<user>` page allows a user's comments to execute arbitrary javascript code. The html template `user.html` contains the following code snippet to render comments made…

    DogukanUrker flaskBlog