CVE-2024-27083

Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker could trick a user to follow a specially crafted URL to the OAuth login page. This URL could inject and execute malicious javascript code that would get executed on the user's browser. This issue was introduced on 4.1.4 and patched on 4.2.1.

• CWE-79
• CWE-79

• https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812Patch
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84Vendor Advisory
• https://github.com/dpgaspar/Flask-AppBuilder/commit/3d17741886e4b3c384d0570de69689e4117aa812Patch
• https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-fqxj-46wg-9v84Vendor Advisory

Published

Feb 29, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-27078In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-27079In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-2708A vulnerability was found in Tenda AC10U 15.03.06.49 and cla…8.8
• CVE-2024-27080In the Linux kernel, the following vulnerability has been re…4.7
• CVE-2024-27081ESPHome is a system to control your ESP8266/ESP32. A securit…8.8
• CVE-2024-27082Cacti provides an operational monitoring and fault managemen…5.4
• CVE-2024-27084Rejected reason: This CVE is a duplicate of CVE-2024-1631.
• CVE-2024-27085Discourse is an open source platform for community discussio…6.5
• CVE-2024-27086The MSAL library enabled acquisition of security tokens to c…3.9
• CVE-2024-27087Kirby is a content management system. The new link field int…5.4
• CVE-2024-27088es5-ext contains ECMAScript 5 extensions. Passing functions …5.5
• CVE-2024-27089Rejected reason: This candidate was withdrawn by its CNA. Fu…