Flatpress
by Flatpress
Source repositories
CVEs (36)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-22761 | Hig | 0.57 | 8.8 | 0.01 | Jul 30, 2021 | Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php. | ||
| CVE-2024-41290 | Hig | 0.53 | 8.1 | 0.00 | Oct 2, 2024 | FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. | ||
| CVE-2022-40048 | Hig | 0.47 | 7.2 | 0.01 | Sep 29, 2022 | Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function. | ||
| CVE-2025-29602 | Med | 0.40 | 6.1 | 0.00 | May 7, 2025 | flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories. | ||
| CVE-2024-25412 | Med | 0.40 | 6.1 | 0.01 | Sep 27, 2024 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field. | ||
| CVE-2024-33210 | Med | 0.35 | 5.4 | 0.01 | Oct 2, 2024 | A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. | ||
| CVE-2024-33209 | Med | 0.35 | 5.4 | 0.01 | Oct 2, 2024 | FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows them to execute arbitrary code in the context of a victim's web browser. | ||
| CVE-2022-40047 | Med | 0.35 | 5.4 | 0.01 | Oct 11, 2022 | Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php. | ||
| CVE-2021-41432 | Med | 0.35 | 5.4 | 0.02 | Jun 23, 2022 | A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content. | ||
| CVE-2022-24588 | Med | 0.35 | 5.4 | 0.01 | Feb 15, 2022 | Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function. | ||
| CVE-2020-35241 | Med | 0.34 | 4.8 | 0.02 | Dec 30, 2020 | FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can… | ||
| CVE-2025-25460 | Med | 0.31 | 4.8 | 0.01 | Feb 24, 2025 | A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The… | ||
| CVE-2024-31835 | Med | 0.31 | 4.8 | 0.01 | Oct 1, 2024 | Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter. | ||
| CVE-2022-4606 | Cri | 0.03 | 9.8 | 0.35 | Dec 18, 2022 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. | ||
| CVE-2009-4461 | 0.03 | — | 0.01 | Dec 30, 2009 | Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) contact.php, (2) login.php, and (3) search.php. | |||
| CVE-2008-4120 | 0.03 | — | 0.02 | Sep 29, 2008 | Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) pass parameter to login.php, or the (3) name parameter to contact.php. | |||
| CVE-2026-56785 | 0.00 | — | 0.00 | Jun 23, 2026 | FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript… | |||
| CVE-2025-44108 | Med | 0.00 | 4.8 | 0.00 | May 19, 2025 | A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently. | ||
| CVE-2024-9847 | Hig | 0.00 | 8.0 | 0.00 | Mar 20, 2025 | FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a… | ||
| CVE-2024-9699 | Med | 0.00 | 5.4 | 0.00 | Mar 20, 2025 | A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by… |
- risk 0.57cvss 8.8epss 0.01
Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.
- risk 0.53cvss 8.1epss 0.00
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.
- risk 0.47cvss 7.2epss 0.01
Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.
- risk 0.40cvss 6.1epss 0.00
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
- risk 0.40cvss 6.1epss 0.01
A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field.
- risk 0.35cvss 5.4epss 0.01
A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users.
- risk 0.35cvss 5.4epss 0.01
FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows them to execute arbitrary code in the context of a victim's web browser.
- risk 0.35cvss 5.4epss 0.01
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
- risk 0.35cvss 5.4epss 0.02
A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands through blog content.
- risk 0.35cvss 5.4epss 0.01
Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
- risk 0.34cvss 4.8epss 0.02
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can…
- risk 0.31cvss 4.8epss 0.01
A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The…
- risk 0.31cvss 4.8epss 0.01
Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter.
- risk 0.03cvss 9.8epss 0.35
PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3.
- CVE-2009-4461Dec 30, 2009risk 0.03cvss —epss 0.01
Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.909 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to (1) contact.php, (2) login.php, and (3) search.php.
- CVE-2008-4120Sep 29, 2008risk 0.03cvss —epss 0.02
Multiple cross-site scripting (XSS) vulnerabilities in FlatPress 0.804 allow remote attackers to inject arbitrary web script or HTML via the (1) user or (2) pass parameter to login.php, or the (3) name parameter to contact.php.
- CVE-2026-56785Jun 23, 2026risk 0.00cvss —epss 0.00
FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript…
- risk 0.00cvss 4.8epss 0.00
A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.
- risk 0.00cvss 8.0epss 0.00
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a…
- risk 0.00cvss 5.4epss 0.00
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by…
Page 1 of 2