CVE-2024-41290

CVE-2024-41290 FlatPress CMS v1.3.1 1.3 wurde festgestellt, dass es unsichere Methoden zur Speicherung von Authentifizierungsdaten verwendet. Zusätzliche Informationen: FlatPress CMS Version 1.3.1 speichert authentifizierungsbezogene Daten, einschließlich Benutzernamen und gehashter Passwörter,...

CVE-2024-33210

CVE-2024-33210 In Flatpress 1.3 wurde eine Cross-Site-Scripting-Schwachstelle XSS identifiziert. Diese Schwachstelle ermöglicht es einem Angreifer, bösartige Skripte in Webseiten einzuschleusen, die von anderen Benutzern angezeigt werden. Vulnerability Type: Cross Site Scripting XSS Vendor of...

CVE-2024-33209

CVE-2024-33209 FlatPress 1.3 è vulnerabile a Cross Site Scripting XSS. Un attaccante può iniettare codice JavaScript malevolo nella sezione "Aggiungi Nuovo Articolo", che gli consente di eseguire codice arbitrario nel contesto del browser web della vittima. Tipo di Vulnerabilità: Cross Site...

CVE-2024-31835

CVE-2024-31835 Vulnerabilità di Cross Site Scripting in flatpress CMS Flatpress v1.3 che consente a un attaccante remoto di eseguire codice arbitrario tramite un payload appositamente creato nel parametro del nome del file. Componente interessato: Campo di caricamento file del pannello di...

CVE-2024-25412

CVE-2024-25412 Una vulnerabilità di cross-site scripting XSS in Flatpress v1.3 consente agli aggressori di eseguire script web arbitrari o HTML tramite un payload appositamente creato iniettato nel campo email. Tipo di vulnerabilità: Cross Site Scripting XSS Fornitore del prodotto:...

CVE-2024-25411

CVE-2024-25411 Una vulnerabilità di cross-site scripting XSS in Flatpress v1.3 consente agli attaccanti di eseguire script web arbitrari o HTML tramite un payload appositamente creato iniettato nel parametro username in setup.php Tipo di vulnerabilità : Cross Site Scripting XSS Vendor del prodott...

FlatPress 1.2.1 - Stored Cross-Site Scripting

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks. id: CVE-2021-41432 info: name: FlatPress 1.2.1 -...

Flatpress < v1.2.1 - Cross Site Scripting

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting XSS vulnerability via the page parameter at /flatpress/admin.php. id: CVE-2022-40047 info: name: Flatpress v1.2.1 - Cross Site Scripting author: r3Y3r53 severity: medium description: | Flatpress v1.2.1 was discovered to...

Flatpress < 1.3 - Path Traversal

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. id: CVE-2023-0947 info: name: Flatpress 1.3 - Path Traversal author: r3Y3r53 severity: critical description: | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. impact: | Unauthenticated attackers ca...

CVE-2025-29602

CVE-2025-29602 - Gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke in FlatPress CMS 1.3.1 Beschreibung Eine gespeicherte Cross-Site-Scripting XSS-Sicherheitslücke existiert im Administrationsbereich von Flatpress CMS 1.3.1. Ein Angreifer mit Admin-Rechten kann eine bösartige...

CVE-2025-44108-SXSS

CVE-2025-44108 - FlatPress CMS 1.3.1의 저장형 XSS교차 사이트 스크립팅 취약점 설명 Flatpress CMS 1.3.1의 관리자 패널에 저장형 교차 사이트 스크립팅XSS 취약점이 존재합니다. 관리자 권한을 가진 공격자가 악성 JavaScript 페이로드를 시스템에 주입하면, 이 페이로드가 영구적으로 저장됩니다. 일반 사용자가 손상된 페이지예: 블로그 게시물를 방문하면, 주입된 페이로드가 피해자의 브라우저에서 자동으로 실행됩니다. 영향을 받는 제품 Flatpress 버전: 업로더 - 갤러리 캡션에서...

CVE-2025-25460

FlatPress CMS Gespeichertes XSS in v1.3.1 CVE-2025-25460 Autor: Athul S Beschreibung Eine gespeicherte Cross-Site Scripting XSS Sicherheitslücke wurde in FlatPress 1.3.1 in der "Add Entry" Funktion identifiziert. Diese Sicherheitslücke erlaubt es authentifizierten Angreifern , bösartige...

EUVD-2026-38634

FlatPress versions prior to commit 10be83c, contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields ...

CVE-2026-56785

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in...

CVE-2026-56785

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in...

CVE-2026-56785 FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in...

CVE-2026-56785 FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in...

CVE-2026-56785 FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in...

CVE-2026-56785

FlatPress is affected by a stored cross-site scripting (XSS) vulnerability in comment and contact forms. Versions prior to commit 10be83c (FlatPress) render the name, URL, and email fields without proper output encoding in Smarty templates, allowing an attacker to inject arbitrary HTML/JavaScript...

PT-2026-51608

Name of the Vulnerable Software and Affected Versions FlatPress versions prior to commit 10be83c Description A stored cross-site scripting issue exists in comment and contact forms. The name, URL, and email fields are rendered without proper output encoding in Smarty templates. This allows...