CVE-2023-33175

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

ToUI is a Python package for creating user interfaces (websites and desktop apps) from HTML. ToUI is using Flask-Caching (SimpleCache) to store user variables. Websites that use `Website.user_vars` property. It affects versions 2.0.1 to 2.4.0. This issue has been patched in version 2.4.1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-914 CWE-913

Affected software

Vendor	Product	Versions
mubarakalmehairbi	ToUI	>= 2.0.1, < 2.4.1

References

https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1Release Notes
https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563Vendor Advisory
https://github.com/mubarakalmehairbi/ToUI/releases/tag/v2.4.1Release Notes
https://github.com/mubarakalmehairbi/ToUI/security/advisories/GHSA-hh7j-pg39-q563Vendor Advisory

Timeline

Published: May 30, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-331766.5BigBlueButton is an open source virtual classroom designed to help teachers teach and learners learn. In affected versions are affected by a CVE-2023-331778.8Xibo is a content management system (CMS). A path traversal vulnerability exists in the Xibo CMS whereby a specially crafted zip file can be CVE-2023-331786.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered in the `/dataset/data/{id}` API route inside the CM CVE-2023-331796.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.CVE-2023-33185.4A vulnerability was found in SourceCodester Resort Management System 1.0. It has been declared as problematic. Affected by this vulnerabilit CVE-2023-331806.5Xibo is a content management system (CMS). An SQL injection vulnerability was discovered starting in version 3.2.0 and prior to version 3.3.CVE-2023-331815.3Xibo is a content management system (CMS). Starting in version 3.0.0 and prior to version 3.3.5, some API routes will print a stack trace wh CVE-2023-331824.3Contacts app for Nextcloud easily syncs contacts from various devices with your Nextcloud and allows editing. The unsanitized SVG is convert CVE-2023-331834.3Calendar app for Nextcloud easily sync events from various devices with your Nextcloud. Some internal paths of the website are disclosed whe CVE-2023-331845.3Nextcloud Mail is a mail app in Nextcloud. A blind SSRF attack allowed to send GET requests to services running in the same web server. It i CVE-2023-331855.4Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service.CVE-2023-331866.1Zulip is an open-source team collaboration tool with unique topic-based threading that combines the best of email and chat to make remote wo