flatcore

Records23All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high8CVSS 7.0–8.9

Exploited now

flatcore records in CISA KEV

No flatcore vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Flatcore-cms 13 records MEDIUM Flatcore 10 records MEDIUM

Records

10 records in Flatcore · all components

TI-2021-17581 CVE-2021-40555 · GHSA-rp7v-crhj-652h

Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to…

MEDIUM 58

Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00439 Published 2023-02-16 No fix listed CWE-79

TI-2019-10413 CVE-2019-13961 · GHSA-836h-9m9x-w2qm

A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary…

MEDIUM 42

A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.02254 Published 2019-07-18 No fix listed CWE-352

TI-2019-07947 CVE-2019-10652 · GHSA-jwqc-3f2x-pg44

An issue was discovered in flatCore 1.4.7.

MEDIUM 41

An issue was discovered in flatCore 1.4.7.

CVSS 3.0HIGH 7.2 Network High privileges No interaction EPSS 0.06961 Published 2019-03-30 No fix listed CWE-434

TI-2020-13217 CVE-2020-17452 · GHSA-v8ph-72jw-j36g

flatCore before 1.5.7 allows upload and execution of a .php file by an admin.

LOW 36

flatCore before 1.5.7 allows upload and execution of a .php file by an admin.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02429 Published 2020-08-09 No fix listed CWE-434

TI-2021-06201 CVE-2021-23837 · GHSA-r9gv-5v96-9377

An issue was discovered in flatCore before 2.0.0 build 139.

LOW 32

An issue was discovered in flatCore before 2.0.0 build 139.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01481 Published 2021-01-15 No fix listed CWE-89

TI-2017-06862 CVE-2017-9451 · GHSA-5x93-pjrr-4q9x

Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows…

LOW 29

Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF']…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00744 Published 2017-06-06 No fix listed CWE-79

TI-2021-06199 CVE-2021-23835 · GHSA-32wp-rjr7-9fg7

An issue was discovered in flatCore before 2.0.0 build 139.

LOW 26

An issue was discovered in flatCore before 2.0.0 build 139.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.017 Published 2021-01-15 No fix listed CWE-20

TI-2021-06202 CVE-2021-23838 · GHSA-w58h-cm85-98cc

An issue was discovered in flatCore before 2.0.0 build 139.

LOW 24

An issue was discovered in flatCore before 2.0.0 build 139.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00993 Published 2021-01-15 No fix listed CWE-79

TI-2021-06200 CVE-2021-23836 · GHSA-2843-wghw-w3qp

An issue was discovered in flatCore before 2.0.0 build 139.

LOW 24

An issue was discovered in flatCore before 2.0.0 build 139.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00933 Published 2021-01-15 No fix listed CWE-79

TI-2020-13216 CVE-2020-17451 · GHSA-m5g4-cg24-mc6m

flatCore before 1.5.7 allows XSS by an admin via the…

LOW 23

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagen…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00611 Published 2020-08-09 No fix listed CWE-79

Open these records in search →