CVE-2021-27679: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name...

PT-2021-17600

Name of the Vulnerable Software and Affected Versions Batflat CMS version 1.3.6 Description The issue allows remote attackers to inject arbitrary web script or HTML via the field name variable, potentially leading to cross-site scripting XSS attacks. This could enable attackers to execute malicio...

PT-2021-17602

Name of the Vulnerable Software and Affected Versions: Batflat CMS version 1.3.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the field name variable, potentially leading to cross-site scripting XSS attacks. This could enable attackers to execute...

PT-2021-17601

Name of the Vulnerable Software and Affected Versions: Batflat CMS version 1.3.6 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the field name variable, which can lead to cross-site scripting XSS attacks. Recommendations: For Batflat CMS version 1.3.6,...

Batflat CMS cross-site scripting vulnerability

Batflat is a simple, lightweight content management system CMS. A cross-site scripting vulnerability exists in Galleries in Batflat 1.3.6. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML via field names...

CVE-2021-27677: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name...

Paweł Klockiewicz Batflat CMS cross-site scripting vulnerability

Batflat is a simple, lightweight content management system CMS. A cross-site scripting vulnerability exists in "Navigation" in Batflat 1.3.6, which can be exploited by remote attackers to inject arbitrary web script or HTML via a field name...

CVE-2021-27678: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name...

Batflat CMS 1.3.6 Cross Site Scripting

Exploit Title: Batflat CMS 1.3.6 - 'multiple' Stored XSS Date: 22/02/2021 Exploit Author: Tadjmen Vendor Homepage: https://batflat.org/ Software Link: https://github.com/sruupl/batflat/archive/master.zip Version: 1.3.6 Tested on: Xammpp on Windows, Firefox Newest CVE : N/A Multiple Stored XSS...

Batflat CMS 1.3.6 - multiple Stored XSS Vulnerabilities

Exploit Title: Batflat CMS 1.3.6 - 'multiple' Stored XSS Exploit Author: Tadjmen Vendor Homepage: https://batflat.org/ Software Link: https://github.com/sruupl/batflat/archive/master.zip Version: 1.3.6 Tested on: Xammpp on Windows, Firefox Newest CVE : N/A Multiple Stored XSS Cross-Site Scripting...

Batflat CMS 1.3.6 - 'multiple' Stored XSS

Exploit Title: Batflat CMS 1.3.6 - 'multiple' Stored XSS Date: 22/02/2021 Exploit Author: Tadjmen Vendor Homepage: https://batflat.org/ Software Link: https://github.com/sruupl/batflat/archive/master.zip Version: 1.3.6 Tested on: Xammpp on Windows, Firefox Newest CVE : N/A Multiple Stored XSS...

Batflat CMS 1.3.6 - Remote Code Execution (Authenticated) Exploit

Exploit Title: Batflat CMS 1.3.6 - Remote Code Execution Authenticated Exploit Author: mari0x00 Vendor Homepage: https://batflat.org/ Software Link: https://github.com/sruupl/batflat/archive/master.zip Description:...

CVE-2020-35734

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection and consequently Remote Code Execution via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data username, displayed name, etc.. NOTE: This...

CVE-2020-35734

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection and consequently Remote Code Execution via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data username, displayed name, etc.. NOTE: This...

Code injection

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection and consequently Remote Code Execution via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data username, displayed name, etc.. NOTE: This...

CVE-2020-35734

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection and consequently Remote Code Execution via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data username, displayed name, etc.. NOTE: This...

CVE-2020-35734

Batflat CMS 1.3.6 is vulnerable to authenticated code injection leading to Remote Code Execution via input fields on the Users tab. Exploitation requires login to the admin panel and editing another user’s data (e.g., username or display name). Affected product/version: Batflat 1.3.6; vendor note...

Batflat Code Injection Vulnerability

Batflat is a free lightweight, fast and simple CMS from Batflat. A code injection vulnerability exists in Batflat 1.3.6 that stems from the failure of a web system or product to properly filter specific elements of externally entered data during the construction of a code snippet. An attacker cou...

CVE-2020-35734: Improper Control of Generation of Code

Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection and consequently Remote Code Execution via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data username, displayed name, etc.. NOTE: This...

PT-2021-11840 · Batflat · Batflat

Name of the Vulnerable Software and Affected Versions: Batflat version 1.3.6 Description: The issue allows an authenticated user to perform code injection, and consequently Remote Code Execution, via the input fields of the Users tab. To exploit this, one must login to the administration panel an...