Lucene search
K
Database
Vendors
Products
Timeline
Vulnerabilities
Perimeter Scanner
Scanning
Projects
Scanner
Agent Scanning
API Scanning
Manual Audit
Email
Webhook
Resources
Documents
Blog
Glossary
FAQ
Plugins
Pricing
Contacts
About Us
Partners
Branding Guideline
Settings
Sign in
FlatcoreFlatcore

10 matches found

CVE
CVE•added 2021/01/15 7:15 a.m.•91 views

CVE-2021-23835

An issue was discovered in flatCore before 2.0.0 build 139. A local file disclosure vulnerability was identified in the docs_file HTTP request body parameter for the acp interface. This can be exploited with admin access rights. The affected parameter (which retrieves the contents of the specified ...

4.9CVSS4.9AI score0.0164EPSS
CVE
CVE•added 2019/07/18 8:15 p.m.•70 views

CVE-2019-13961

A CSRF vulnerability was found in flatCore before 1.5, leading to the upload of arbitrary .php files via acp/core/files.upload-script.php.

8.8CVSS8.7AI score0.00251EPSS
CVE
CVE•added 2021/01/15 7:15 a.m.•66 views

CVE-2021-23837

An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to be accepting maliciou...

6.5CVSS6.9AI score0.00781EPSS
CVE
CVE•added 2021/01/15 7:15 a.m.•66 views

CVE-2021-23838

An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious use...

4.8CVSS4.8AI score0.0034EPSS
CVE
CVE•added 2021/01/15 7:15 a.m.•63 views

CVE-2021-23836

An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. Th...

4.8CVSS4.8AI score0.004EPSS
CVE
CVE•added 2020/08/09 7:15 p.m.•41 views

CVE-2020-17451

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.

4.8CVSS4.9AI score0.00235EPSS
CVE
CVE•added 2020/08/09 7:15 p.m.•39 views

CVE-2020-17452

flatCore before 1.5.7 allows upload and execution of a .php file by an admin.

9CVSS7AI score0.00835EPSS
CVE
CVE•added 2017/06/06 4:29 p.m.•35 views

CVE-2017-9451

Cross site scripting (XSS) vulnerability in pages.edit_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via the PATH_INFO in an acp.php URL, due to use of unsanitized $_SERVER['PHP_SELF'] to generate URLs.

6.1CVSS6AI score0.00217EPSS
CVE
CVE•added 2019/03/30 2:29 p.m.•34 views

CVE-2019-10652

An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .php files, related to the addons feature.

7.2CVSS6.7AI score0.04121EPSS
CVE
CVE•added 2023/02/16 4:15 p.m.•31 views

CVE-2021-40555

Cross site scripting (XSS) vulnerability in flatCore-CMS 2.2.15 allows attackers to execute arbitrary code via description field on the new page creation form.

5.4CVSS5.5AI score0.0008EPSS