33 matches found
CVE-2024-9699
CVE-2024-9699 affects FlatPress CMS: the file-upload feature in the admin panel allows a JavaScript payload masquerading as a filename, enabling Cross-Site Scripting when the uploaded file is accessed. The issue is described for the default/“latest” release and is stated to be fixed in version 1....
CVE-2024-9847 Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery CSRF attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress...
CVE-2024-9847
CVE-2024-9847 affects FlatPress CMS (FlatPress) where authenticated users can be targeted by a Cross-Site Request Forgery (CSRF) flaw to enable or disable plugins on behalf of a victim user. The vulnerability arises from attackers using crafted requests that are processed as if initiated by the l...
CVE-2024-9847 Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery CSRF attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress...
CVE-2024-9847 Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery CSRF attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress...
CVE-2024-41290
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component...
CVE-2024-41290
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component...
CVE-2024-41290
FlatPress CMS versions 1.3.1 (
CVE-2024-41290
FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component...
CVE-2024-31835
Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter...
PT-2024-29349 · Unknown · Flatpress Cms
Name of the Vulnerable Software and Affected Versions: FlatPress CMS versions 1.3.1 through 1.3 Description: The issue concerns the use of insecure methods to store authentication data via the cookie's component. This could potentially lead to unauthorized access. No information is provided about...