CVE-2020-17451

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 pagelinkname, pagetitle, pagecontent, or pageextracontent parameter, or the acp/acp.php?tn=system&sub=syspref prefspagename, prefspagetitle, or prefspagesubtitle parameter...

PT-2020-15000

Name of the Vulnerable Software and Affected Versions flatCore versions prior to 1.5.7 Description The issue allows for XSS by an admin via specific parameters in the "acp/acp.php" endpoint, including page linkname, page title, page content, or page extracontent when editing a page, or prefs...

CVE-2020-17451: Improper Neutralization of Input During Web Page Generation

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 pagelinkname, pagetitle, pagecontent, or pageextracontent parameter, or the acp/acp.php?tn=system&sub=syspref prefspagename, prefspagetitle, or prefspagesubtitle parameter...

CVE-2019-10652: Unrestricted Upload of File with Dangerous Type

An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature...

PT-2019-11965

Name of the Vulnerable Software and Affected Versions flatCore version 1.4.7 Description An issue was discovered that allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature in acp/acp.php. Recommendations For flatCore version 1.4.7, consider...

CVE-2017-8868

acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF...

PT-2017-18593

Name of the Vulnerable Software and Affected Versions flatCore version 1.4.7 Description The issue allows file deletion through directory traversal in the delete parameter to "acp/acp.php". The risk might be limited to requests submitted through CSRF. Recommendations For flatCore version 1.4.7,...