Medium severity4.8NVD Advisory· Published Jan 15, 2021· Updated Jun 17, 2026
CVE-2021-23836
CVE-2021-23836
Description
An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The injected payload will be executed in the browser of a user whenever one visits the affected module page.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3cpe:2.3:a:flatcore:flatcore:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:flatcore:flatcore:*:*:*:*:*:*:*:*range: <=2.0.0
- (no CPE)range: <2.0.0 build 139
- flatCore/flatCoredescription
Patches
Vulnerability mechanics
References
2- packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.htmlnvdExploitThird Party AdvisoryVDB Entry
- sec-consult.com/vulnerability-lab/nvdThird Party Advisory
News mentions
0No linked articles in our index yet.