Flatcore
Products
1- 23 CVEs
Recent CVEs
23| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-7878 | Cri | 0.64 | 9.8 | 0.01 | Apr 14, 2017 | SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database. | ||
| CVE-2017-7877 | Hig | 0.57 | 8.8 | 0.01 | Apr 14, 2017 | CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations. | ||
| CVE-2017-8868 | Hig | 0.49 | 7.5 | 0.02 | May 10, 2017 | acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF. | ||
| CVE-2017-7879 | Hig | 0.49 | 7.5 | 0.01 | Apr 14, 2017 | SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database. | ||
| CVE-2017-1000428 | Med | 0.40 | 6.1 | 0.01 | Jan 10, 2018 | flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string. | ||
| CVE-2017-9451 | Med | 0.40 | 6.1 | 0.01 | Jun 6, 2017 | Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs. | ||
| CVE-2021-39608 | 0.04 | — | 0.46 | Aug 23, 2021 | Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code. | |||
| CVE-2019-10652 | 0.04 | — | 0.07 | Mar 30, 2019 | An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature. | |||
| CVE-2019-13961 | 0.03 | — | 0.02 | Jul 18, 2019 | A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php. | |||
| CVE-2021-40555 | 0.00 | — | 0.00 | Feb 16, 2023 | Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form. | |||
| CVE-2022-43118 | 0.00 | — | 0.00 | Nov 9, 2022 | A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field. | |||
| CVE-2021-41402 | 0.00 | — | 0.01 | Jun 16, 2022 | flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code. | |||
| CVE-2021-41403 | 0.00 | — | 0.17 | Jun 15, 2022 | flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities. | |||
| CVE-2021-40902 | 0.00 | — | 0.00 | Jun 13, 2022 | flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page. | |||
| CVE-2021-42245 | 0.00 | — | 0.01 | Jun 6, 2022 | FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections. | |||
| CVE-2021-3745 | 0.00 | — | 0.01 | Oct 28, 2021 | flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type | |||
| CVE-2021-39609 | 0.00 | — | 0.02 | Aug 23, 2021 | Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function. | |||
| CVE-2021-23838 | 0.00 | — | 0.01 | Jan 15, 2021 | An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For… | |||
| CVE-2021-23837 | 0.00 | — | 0.01 | Jan 15, 2021 | An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to… | |||
| CVE-2021-23836 | 0.00 | — | 0.01 | Jan 15, 2021 | An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of… |
- risk 0.64cvss 9.8epss 0.01
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read and write to the users database.
- risk 0.57cvss 8.8epss 0.01
CSRF vulnerability in flatCore version 1.4.6 allows remote attackers to modify CMS configurations.
- risk 0.49cvss 7.5epss 0.02
acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.
- risk 0.49cvss 7.5epss 0.01
SQL Injection vulnerability in flatCore version 1.4.6 allows an attacker to read the content database.
- risk 0.40cvss 6.1epss 0.01
flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.
- risk 0.40cvss 6.1epss 0.01
Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.
- CVE-2021-39608Aug 23, 2021risk 0.04cvss —epss 0.46
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
- CVE-2019-10652Mar 30, 2019risk 0.04cvss —epss 0.07
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature.
- CVE-2019-13961Jul 18, 2019risk 0.03cvss —epss 0.02
A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.
- CVE-2021-40555Feb 16, 2023risk 0.00cvss —epss 0.00
Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.
- CVE-2022-43118Nov 9, 2022risk 0.00cvss —epss 0.00
A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
- CVE-2021-41402Jun 16, 2022risk 0.00cvss —epss 0.01
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
- CVE-2021-41403Jun 15, 2022risk 0.00cvss —epss 0.17
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
- CVE-2021-40902Jun 13, 2022risk 0.00cvss —epss 0.00
flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
- CVE-2021-42245Jun 6, 2022risk 0.00cvss —epss 0.01
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
- CVE-2021-3745Oct 28, 2021risk 0.00cvss —epss 0.01
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
- CVE-2021-39609Aug 23, 2021risk 0.00cvss —epss 0.02
Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
- CVE-2021-23838Jan 15, 2021risk 0.00cvss —epss 0.01
An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For…
- CVE-2021-23837Jan 15, 2021risk 0.00cvss —epss 0.01
An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to…
- CVE-2021-23836Jan 15, 2021risk 0.00cvss —epss 0.01
An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of…