CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 20/03/2025 |
| CVE-2024-9699 | 中危5.4 | A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1. | 20/03/2025 |
| CVE-2024-4023 | 高危8.1 | A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading to the file being processed as an HTML file. This allows an a | 20/03/2025 |
| CVE-2025-25460 | 中危4.8 | A stored Cross-Site Scripting (XSS) vulnerability was identified in FlatPress 1.3.1 within the "Add Entry" feature. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads into blog posts, which are executed when other users view the posts. The issue arises due to improper input saniti | 24/02/2025 |
| CVE-2024-41290 | 高危8.1 | FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component. | 02/10/2024 |
| CVE-2024-33210 | 中危5.4 | A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3. This vulnerability allows an attacker to inject malicious scripts into web pages viewed by other users. | 02/10/2024 |
| CVE-2024-33209 | 中危5.4 | FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS). An attacker can inject malicious JavaScript code into the "Add New Entry" section, which allows them to execute arbitrary code in the context of a victim's web browser. | 02/10/2024 |
| CVE-2024-31835 | 中危4.8 | Cross Site Scripting vulnerability in flatpress CMS Flatpress v1.3 allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter. | 01/10/2024 |
| CVE-2024-25412 | 中危6.1 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email field. | 27/09/2024 |
| CVE-2024-25411 | 中危6.1 | A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username parameter in setup.php. | 27/09/2024 |
| CVE-2023-1148 | 中危4.8 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. | 02/03/2023 |
| CVE-2023-1147 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. | 02/03/2023 |
| CVE-2023-1146 | 中危5.4 | Cross-site Scripting (XSS) - Generic in GitHub repository flatpressblog/flatpress prior to 1.3. | 02/03/2023 |
| CVE-2023-1107 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. | 02/03/2023 |
| CVE-2023-1106 | 中危6.1 | Cross-site Scripting (XSS) - Reflected in GitHub repository flatpressblog/flatpress prior to 1.3. | 02/03/2023 |
| CVE-2023-1105 | 高危8.1 | External Control of File Name or Path in GitHub repository flatpressblog/flatpress prior to 1.3. | 01/03/2023 |
| CVE-2023-1104 | 中危5.4 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. | 01/03/2023 |
| CVE-2023-0947 | 严重9.8 | Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3. | 22/02/2023 |