Priority MEDIUM 61
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.45948 · Published 2021-08-23 · No fix listed CWE-434
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00494 · Published 2022-11-09 · No fix listed CWE-79
Priority MEDIUM 60
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19103 · Published 2022-06-15 · No fix listed CWE-918
Priority MEDIUM 58
Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00439 · Published 2023-02-16 · No fix listed CWE-79
Priority MEDIUM 44
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01022 · Published 2017-04-14 · No fix listed CWE-89
Priority MEDIUM 42
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.02254 · Published 2019-07-18 · No fix listed CWE-352
Priority MEDIUM 41
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01529 · Published 2022-06-16 · No fix listed CWE-94
Priority MEDIUM 41
An issue was discovered in flatCore 1.4.7.
CVSS 3.0HIGH 7.2· Network · High privileges · No interaction · EPSS 0.06961 · Published 2019-03-30 · No fix listed CWE-434
Priority MEDIUM 40
CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.00906 · Published 2017-04-14 · No fix listed CWE-352
Priority LOW 37
acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01854 · Published 2017-05-10 · No fix listed CWE-22
Priority LOW 36
flatCore before 1.5.7 allows upload and execution of a .php file by an admin.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.02429 · Published 2020-08-09 · No fix listed CWE-434
Priority LOW 35
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01029 · Published 2017-04-14 · No fix listed CWE-89
Priority LOW 32
An issue was discovered in flatCore before 2.0.0 build 139.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01481 · Published 2021-01-15 · No fix listed CWE-89
Priority LOW 31
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.0111 · Published 2021-10-28 · No fix listed CWE-434
Priority LOW 29
flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00836 · Published 2018-01-10 · No fix listed CWE-79
Priority LOW 29
Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF']…
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00744 · Published 2017-06-06 · No fix listed CWE-79
Priority LOW 28
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00724 · Published 2022-06-06 · No fix listed CWE-79
Priority LOW 28
Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01714 · Published 2021-08-23 · No fix listed CWE-79
Priority LOW 26
An issue was discovered in flatCore before 2.0.0 build 139.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.017 · Published 2021-01-15 · No fix listed CWE-20
Priority LOW 25
flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00487 · Published 2022-06-13 · No fix listed CWE-79
Priority LOW 24
An issue was discovered in flatCore before 2.0.0 build 139.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00993 · Published 2021-01-15 · No fix listed CWE-79
Priority LOW 24
An issue was discovered in flatCore before 2.0.0 build 139.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00933 · Published 2021-01-15 · No fix listed CWE-79
Priority LOW 23
flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagen…
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00611 · Published 2020-08-09 · No fix listed CWE-79
THREATIST.IORead the docs