Priority MEDIUM 55
A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00347 · Published 2025-05-19 · No fix listed CWE-79
Priority MEDIUM 60
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00292 · Published 2025-05-07 · No fix listed CWE-79
Priority HIGH 68
A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3.
CVSS 3.0HIGH 8.1· Network · No auth · User interaction · EPSS 0.00808 · Published 2025-03-20 · Fixed in 1.3 CWE-79
Priority MEDIUM 60
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00358 · Published 2025-03-20 · Fixed in 1.4.dev CWE-79
Priority HIGH 70
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user.
CVSS 3.0HIGH 8.0· Network · High privileges · No interaction · EPSS 0.00342 · Published 2025-03-20 · Fixed in 1.4.dev CWE-352
Priority MEDIUM 55
A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00546 · Published 2025-02-24 · No fix listed CWE-79
Priority LOW 38
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0043 · Published 2024-10-02 · No fix listed CWE-315
Priority MEDIUM 58
A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00672 · Published 2024-10-02 · No fix listed CWE-79
Priority LOW 26
FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS).
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.0086 · Published 2024-10-02 · No fix listed CWE-79
Priority MEDIUM 55
Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01066 · Published 2024-10-01 · No fix listed CWE-79
Priority LOW 29
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01022 · Published 2024-09-27 · No fix listed CWE-79
Priority MEDIUM 60
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00854 · Published 2024-09-27 · No fix listed CWE-79
Priority MEDIUM 55
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.00532 · Published 2023-03-02 · Fixed in 1.3 CWE-79
Priority MEDIUM 64
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00479 · Published 2023-03-02 · Fixed in 1.3 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00479 · Published 2023-03-02 · Fixed in 1.3 CWE-79
Priority MEDIUM 58
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.00518 · Published 2023-03-02 · Fixed in 1.3 CWE-79
Priority MEDIUM 60
Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00577 · Published 2023-03-02 · Fixed in 1.3 CWE-79
Priority HIGH 74
External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00711 · Published 2023-03-01 · Fixed in 1.3 CWE-73
Priority MEDIUM 60
Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · User interaction · EPSS 0.006 · Published 2023-03-01 · Fixed in 1.3 CWE-79
Priority HIGH 82
Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03637 · Published 2023-02-22 · Fixed in 1.3 CWE-22
Priority LOW 28
A vulnerability, which was classified as problematic, has been found in FlatPress.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00556 · Published 2022-12-28 · No fix listed CWE-79
Priority LOW 28
A vulnerability classified as problematic was found in FlatPress.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00556 · Published 2022-12-28 · No fix listed CWE-79
Priority LOW 28
A vulnerability classified as problematic has been found in FlatPress.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00562 · Published 2022-12-28 · No fix listed CWE-79
Priority LOW 28
A vulnerability was found in FlatPress and classified as problematic.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00562 · Published 2022-12-27 · No fix listed CWE-79
Priority MEDIUM 44
A vulnerability was found in FlatPress.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00942 · Published 2022-12-27 · No fix listed CWE-22
Load more
THREATIST.IORead the docs