Most recent entries from all

EUVD-2026-210118

fkie_cve-2023-33175

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

GHSA-hh7j-pg39-q563 — toui allows user-specific variables to be shared between users

Affected: PyPI: toui

### Impact Websites that use `Website.user_vars` property in versions.

### Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

### Workarounds Do not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only.

### Explanation ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.

gsd-2023-33175

PYSEC-2026-555 — toui allows user-specific variables to be shared between users

Affected: PyPI: toui

### Impact Websites that use `Website.user_vars` property in versions. ### Patches It affects versions v2.0.1 to v2.4.0. Please upgrade to v2.4.1

### Workarounds Do not use `Website.user_vars` in websites when using versions v2.0.1 to v2.4.0. Also, do not use `Website.signin_user()` in version v2.4.0 only. ### Explanation ToUI is using Flask-Caching (SimpleCache) to store user variables. My misunderstanding was that these caches are stored in the client's browser, but it seems that these are stored in the server side.