Flask Appbuilder
Vendor:
First CVE: Jun 7, 2021 · Active for 5 years
13
Total CVEs
More Total CVEs than 91% of tracked products
2.6
Avg CVEs / Year
Higher CVE frequency than 75% of tracked products
6.2
Avg CVSS
Higher Avg CVSS than 24% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Flask Appbuilder over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jun 7, 2021
5 years ago
Most Recent CVE
Sep 11, 2025
316 days ago
CVE Severity & Scoring
Flask Appbuilder13 CVEs
69%
15%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local1 (7.7%)
Network12 (92.3%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low13 (100.0%)
High0 (0.0%)
Unknown0 (0.0%)
User Interaction
None8 (61.5%)
Unknown0 (0.0%)
Required5 (38.5%)
Privileges Required
Low2 (15.4%)
High1 (7.7%)
None10 (76.9%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (13 CVEs).
13 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41265HIGH Flask-AppBuilder is a development framework built on top of Flask. Verions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a m | Dec 9, 2021 | 8.8 | 28 | NO | NO |
CVE-2024-25128CRITICAL Flask-AppBuilder is an application development framework, built on top of Flask. When Flask-AppBuilder is set to AUTH_TYPE AUTH_OID, it allows an attacker to forge an HTTP request, | Feb 29, 2024 | 9.1 | 25 | NO | NO |
CVE-2023-29005HIGH Flask-AppBuilder versions before 4.3.0 lack rate limiting which can allow an attacker to brute-force user credentials. Version 4.3.0 includes the ability to enable rate limiting us | Apr 10, 2023 | 7.5 | 23 | NO | NO |
CVE-2025-58065MEDIUM Flask-AppBuilder is an application development framework. Prior to version 4.8.1, when Flask-AppBuilder is configured to use OAuth, LDAP, or other non-database authentication metho | Sep 11, 2025 | 6.5 | 22 | NO | NO |
CVE-2022-24776MEDIUM Flask-AppBuilder is an application development framework, built on top of the Flask web framework. Flask-AppBuilder contains an open redirect vulnerability when using database auth | Mar 24, 2022 | 6.1 | 22 | NO | NO |
CVE-2021-32805MEDIUM Flask-AppBuilder is an application development framework, built on top of Flask. In affected versions if using Flask-AppBuilder OAuth, an attacker can share a carefully crafted URL | Sep 8, 2021 | 6.1 | 21 | NO | NO |
CVE-2021-29621MEDIUM Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to | Jun 7, 2021 | 5.3 | 21 | NO | NO |
CVE-2022-21659MEDIUM Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnerability. This vulnerab | Jan 31, 2022 | 5.3 | 20 | NO | NO |
CVE-2025-32962MEDIUM Flask-AppBuilder is an application development framework built on top of Flask. Versions prior to 4.6.2 would allow for a malicious unauthenticated actor to perform an open redirec | May 16, 2025 | 6.1 | 18 | NO | NO |
CVE-2024-27083MEDIUM Flask-AppBuilder is an application development framework, built on top of Flask. A Cross-Site Scripting (XSS) vulnerability has been discovered on the OAuth login page. An attacker | Feb 29, 2024 | 6.1 | 18 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (13 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (13 CVEs).
Media Mentions
Signals from CVEs in this product scope (13 CVEs).
Top CNAs Publishing CVEs For Flask Appbuilder
Top CWEs
Versions
No cataloged versions.