What’s Vulnerable › Vulnerabilities

CVE-2019-16925

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-09-28 · updated 2026-06-17
• Weakness: CWE-79

Description

Flower 0.9.3 has XSS via the name parameter in an @app.task call. NOTE: The project author stated that he doesn't think this is a valid vulnerability. Worker name and task name aren’t user facing configuration options. They are internal backend config options and person having rights to change them already has full access

Affected products

• Flower Project Flower: 1.0.0

References

• https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-name-parameter.html
• https://fatihhcelik.blogspot.com/2019/09/flower-100-has-xss-via-name-parameter.html

Get alerted when CVE-2019-16925 or the next vulnerability affects your stack