Dpgaspar's vulnerability footprint centers on Flask-AppBuilder, a Python web application framework component that facilitates rapid development of administrative interfaces and CRUD operations. Its recurring weakness classes—improper authentication, observable discrepancies, open redirects, and exposure of sensitive information—reflect the authentication and access-control surface area inherent to web administration frameworks, where mishandling of user identity or session state can propagate widely across dependent applications. Defenders should prioritize review of authentication logic and redirect handling in instances of this framework; current exploitation activity and severity counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Dpgaspar over time
Signals from CVEs in this vendor scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41265HIGH Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a m | Dec 9, 2021 | 8.8 | 28 | NO | NO |
CVE-2024-25128CRITICAL Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, | Feb 29, 2024 | 9.1 | 25 | NO | NO |
CVE-2023-29005HIGH Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting us | Apr 10, 2023 | 7.5 | 23 | NO | NO |
CVE-2025-58065MEDIUM Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication metho | Sep 11, 2025 | 6.5 | 22 | NO | NO |
CVE-2022-24776MEDIUM Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database auth | Mar 24, 2022 | 6.1 | 22 | NO | NO |
CVE-2021-32805MEDIUM Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL | Sep 8, 2021 | 6.1 | 21 | NO | NO |
CVE-2021-29621MEDIUM Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to | Jun 7, 2021 | 5.3 | 21 | NO | NO |
CVE-2022-21659MEDIUM Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerab | Jan 31, 2022 | 5.3 | 20 | NO | NO |
CVE-2025-32962MEDIUM Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirec | May 16, 2025 | 6.1 | 18 | NO | NO |
CVE-2024-27083MEDIUM Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker | Feb 29, 2024 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (13 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Dpgaspar.
Media articles that mention a CVE ID that affects a product developed by Dpgaspar — matched by CVE ID, not by vendor name.