What’s Vulnerable › Vulnerabilities
CVE-2025-55737: flaskBlog arbitrary comment delete
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2025-08-19 · updated 2026-06-17
- Weakness: CWE-639
Description
flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, when deleting a comment, there's no validation of the ownership of the comment. Every user can delete an arbitrary comment of another user on every post, by simply intercepting the delete request and changing the commentID. The code that causes the problem is in routes/post.py.
Affected products
- DogukanUrker FlaskBlog: through 2.8.0
References
Get alerted when CVE-2025-55737 or the next vulnerability affects your stack