Medium severity5.4NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026

CVE-2024-9699

Description

A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Flatpress/Flatpressllm-fuzzy
Range: <1.4.dev
flatpressblog/flatpressblog/flatpressv5
Range: unspecified

Patches

Vulnerability mechanics

References

github.com/flatpressblog/flatpress/commit/f364391085334a7eae02aa2320edd6de7466ec85nvdPatch
huntr.com/bounties/a993a05f-be50-4983-a44a-3bbff1ec00dbnvdThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000