flatpressblog

Records37All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical3CVSS 9.0–10.0

CVSS high7CVSS 7.0–8.9

Exploited now

flatpressblog records in CISA KEV

No flatpressblog vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Flatpress 36 records HIGH

Records

36 records in Flatpress · all components

TI-2023-00898 CVE-2023-0947 · GHSA-5g9m-xcv9-gp2f

Path Traversal in flatpressblog/flatpress

HIGH 82

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03637 Published 2023-02-22 Fixed in 1.3 CWE-22

TI-2022-04209 CVE-2022-4606 · GHSA-vp4v-xvfw-88r4

PHP Remote File Inclusion in flatpressblog/flatpress

HIGH 75

PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.35435 Published 2022-12-18 Fixed in 1.3 CWE-98

TI-2023-01045 CVE-2023-1105 · GHSA-2qf9-qchx-rh67

External Control of File Name or Path in flatpressblog/flatpress

HIGH 74

External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00711 Published 2023-03-01 Fixed in 1.3 CWE-73

TI-2022-18965 CVE-2022-40048 · GHSA-ggx5-q6p9-g86r

Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.

HIGH 73

Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01713 Published 2022-09-29 No fix listed CWE-434

TI-2024-09138 CVE-2024-9847 · GHSA-x2w2-frfv-4f2j

Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress

HIGH 70

FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user.

CVSS 3.0HIGH 8.0 Network High privileges No interaction EPSS 0.00342 Published 2025-03-20 Fixed in 1.4.dev CWE-352

TI-2024-03752 CVE-2024-4023 · GHSA-qv9p-39px-hfwc

Stored XSS in flatpressblog/flatpress

HIGH 68

A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.00808 Published 2025-03-20 Fixed in 1.3 CWE-79

TI-2022-04208 CVE-2022-4605 · GHSA-mw92-f8pq-x97p

Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

HIGH 66

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00571 Published 2022-12-18 Fixed in 1.3 CWE-79

TI-2023-01085 CVE-2023-1147 · GHSA-g2v3-w77f-w9wf

Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

MEDIUM 64

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00479 Published 2023-03-02 Fixed in 1.3 CWE-79

TI-2025-21142 CVE-2025-29602 · GHSA-jr2q-36h8-7j24

flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.

MEDIUM 60

flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00292 Published 2025-05-07 No fix listed CWE-79

TI-2024-16728 CVE-2024-25411 · GHSA-g9g7-rmqc-4q4p

A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute…

MEDIUM 60

A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00854 Published 2024-09-27 No fix listed CWE-79

TI-2024-08996 CVE-2024-9699 · GHSA-rqhc-x44r-f23j

Cross-Site Scripting (XSS) in flatpressblog/flatpress

MEDIUM 60

A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00358 Published 2025-03-20 Fixed in 1.4.dev CWE-79

TI-2023-01046 CVE-2023-1106 · GHSA-r774-qpmp-3xv2

Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress

MEDIUM 60

Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00577 Published 2023-03-02 Fixed in 1.3 CWE-79

TI-2023-01044 CVE-2023-1104 · GHSA-9rxm-rvcp-xvp2

Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

MEDIUM 60

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.006 Published 2023-03-01 Fixed in 1.3 CWE-79

TI-2024-21964 CVE-2024-33210 · GHSA-ww63-25p3-whh7

A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.

MEDIUM 58

A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00672 Published 2024-10-02 No fix listed CWE-79

TI-2023-01084 CVE-2023-1146 · GHSA-9hw2-mcj5-xfgx

Cross-site Scripting (XSS) - Generic in flatpressblog/flatpress

MEDIUM 58

Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00479 Published 2023-03-02 Fixed in 1.3 CWE-79

TI-2023-01047 CVE-2023-1107 · GHSA-wxm5-xhhw-9jfc

Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

MEDIUM 58

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00518 Published 2023-03-02 Fixed in 1.3 CWE-79

TI-2025-28588 CVE-2025-44108 · GHSA-8g92-fqgw-q495

A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of…

MEDIUM 55

A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00347 Published 2025-05-19 No fix listed CWE-79

TI-2025-19010 CVE-2025-25460 · GHSA-rfwv-x796-g3w9

A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1…

MEDIUM 55

A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00546 Published 2025-02-24 No fix listed CWE-79

TI-2024-20957 CVE-2024-31835 · GHSA-5wwp-5xg3-xwh6

Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote…

MEDIUM 55

Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.01066 Published 2024-10-01 No fix listed CWE-79

TI-2023-01086 CVE-2023-1148 · GHSA-9vv8-3m8h-r8r4

Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

MEDIUM 55

Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00532 Published 2023-03-02 Fixed in 1.3 CWE-79

TI-2022-04344 CVE-2022-4748 · GHSA-4pqc-653v-h7v2

FlatPress File Delete panel.mediamanager.file.php doItemActions path traversal

MEDIUM 44

A vulnerability was found in FlatPress.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00942 Published 2022-12-27 No fix listed CWE-22

TI-2020-14390 CVE-2020-22761 · GHSA-v4mc-gfxw-3c49

Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.

LOW 39

Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00761 Published 2021-07-29 No fix listed CWE-352

TI-2024-27569 CVE-2024-41290 · GHSA-2m84-36h6-49q2

FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

LOW 38

FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0043 Published 2024-10-02 No fix listed CWE-315

TI-2024-16729 CVE-2024-25412 · GHSA-6jxj-6j73-7fgm

A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute…

LOW 29

A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01022 Published 2024-09-27 No fix listed CWE-79

TI-2022-04418 CVE-2022-4822 · GHSA-mj8c-5prm-5hh6

FlatPress Setup main.lib.php cross site scripting

LOW 28

A vulnerability, which was classified as problematic, has been found in FlatPress.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00556 Published 2022-12-28 No fix listed CWE-79

Open these records in search →