Show filters
13 Total Results
Displaying 1-10 of 13
Sort by:
Attacker Value
Moderate
CVE-2021-39609
Disclosure Date: August 23, 2021 (last updated February 23, 2025)
Cross Site Scripting (XSS) vulnerability exiss in FlatCore-CMS 2.0.7 via the upload image function.
3
Attacker Value
Unknown
CVE-2022-43118
Disclosure Date: November 09, 2022 (last updated February 24, 2025)
A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
0
Attacker Value
Unknown
CVE-2021-41402
Disclosure Date: June 16, 2022 (last updated February 23, 2025)
flatCore-CMS v2.0.8 has a code execution vulnerability, which could let a remote malicious user execute arbitrary PHP code.
0
Attacker Value
Unknown
CVE-2021-41403
Disclosure Date: June 15, 2022 (last updated February 23, 2025)
flatCore-CMS version 2.0.8 calls dangerous functions, causing server-side request forgery vulnerabilities.
0
Attacker Value
Unknown
CVE-2021-40902
Disclosure Date: June 13, 2022 (last updated February 23, 2025)
flatCore-CMS version 2.0.8 is affected by Cross Site Scripting (XSS) in the "Create New Page" option through the index page.
0
Attacker Value
Unknown
CVE-2021-42245
Disclosure Date: June 06, 2022 (last updated February 23, 2025)
FlatCore-CMS 2.0.9 has a cross-site scripting (XSS) vulnerability in pages.edit.php through meta tags and content sections.
0
Attacker Value
Unknown
CVE-2021-3745
Disclosure Date: October 28, 2021 (last updated February 23, 2025)
flatcore-cms is vulnerable to Unrestricted Upload of File with Dangerous Type
0
Attacker Value
Unknown
CVE-2021-39608
Disclosure Date: August 23, 2021 (last updated February 23, 2025)
Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.
0
Attacker Value
Unknown
CVE-2017-1000428
Disclosure Date: January 10, 2018 (last updated November 26, 2024)
flatCore-CMS 1.4.6 is vulnerable to reflected XSS in user_management.php due to the use of $_SERVER['PHP_SELF'] to build links and a stored XSS in the admin log panel by specifying a malformed User-Agent string.
0
Attacker Value
Unknown
CVE-2017-8868
Disclosure Date: May 10, 2017 (last updated November 26, 2024)
acp/core/files.browser.php in flatCore 1.4.7 allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.
0
