Vendors / flatcore Records 23 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 2
CVSS high 8
Exploited now flatcore records in CISA KEV No flatcore vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 61
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
CVSS 3.1 HIGH 7.2· Network · High privileges · No interaction · EPSS 0.45948 · Published 2021-08-23 · No fix listed CWE-434
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00494 · Published 2022-11-09 · No fix listed CWE-79
Priority MEDIUM 60
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19103 · Published 2022-06-15 · No fix listed CWE-918
Priority MEDIUM 44
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
CVSS 3.0 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01022 · Published 2017-04-14 · No fix listed CWE-89
Priority MEDIUM 41
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
CVSS 3.1 HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01529 · Published 2022-06-16 · No fix listed CWE-94
Priority MEDIUM 40
CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
CVSS 3.0 HIGH 8.8· Network · No auth · User interaction · EPSS 0.00906 · Published 2017-04-14 · No fix listed CWE-352
Priority LOW 37
acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01854 · Published 2017-05-10 · No fix listed CWE-22
Priority LOW 35
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
CVSS 3.0 HIGH 7.5· Network · No auth · No interaction · EPSS 0.01029 · Published 2017-04-14 · No fix listed CWE-89
Priority LOW 31
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
CVSS 3.1 MEDIUM 6.6· Network · High privileges · No interaction · EPSS 0.0111 · Published 2021-10-28 · No fix listed CWE-434
Priority LOW 29
flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.
CVSS 3.0 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00836 · Published 2018-01-10 · No fix listed CWE-79
Priority LOW 28
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
CVSS 3.1 MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00724 · Published 2022-06-06 · No fix listed CWE-79
Priority LOW 28
Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.01714 · Published 2021-08-23 · No fix listed CWE-79
Priority LOW 25
flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
CVSS 3.1 MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00487 · Published 2022-06-13 · No fix listed CWE-79
Open these records in search → All records by CVSS severity
2 8 13 0 0
THREATIST.IORead the docs