CVE-2021-23836

The CVE-2021-23836 entry concerns flatCore before 2.0.0 build 139, with a stored XSS in the prefs_smtp_psw parameter of the acp interface. An admin can inject client-side script that executes in a user’s browser when visiting the affected module page. The vulnerability is concrete across multiple...