PT-2025-33855 · Flaskblog · Flaskblog

Davidedc97 · Published 2025-08-19 · Updated 2025-08-19 · CVE-2025-55737

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: flaskBlog versions prior to 2.8.0

Description: flaskBlog is a blog application built with Flask. A flaw exists where there is no validation of comment ownership during deletion. This allows any user to delete comments belonging to other users on any post by intercepting the delete request and modifying the commentID. The vulnerable code is located in routes/post.py.

Recommendations: Update flaskBlog to version 2.8.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-55737

GHSA-6HP9-JV2F-88WR

Affected Products

Flaskblog

References · 5

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55737.json · Exploit
• 🔥 https://github.com/DogukanUrker/FlaskBlog/security/advisories/GHSA-6hp9-jv2f-88wr · Exploit
• https://osv.dev/vulnerability/CVE-2025-55737 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55737 · Security Note
• https://twitter.com/CVEnew/status/1957887006651916727 · Twitter Post