Approved changes feed: RSS · Atom
cpe:2.3:a:flatpress:flatpress:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Flatpress (54927a74-d622-5d82-a5a1-32b443454352) |
|---|---|
| Product | Flatpress (9f8b0a99-be38-589f-990b-3a02c5c90eef) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/flatpressblog/flatpress |
purl2cpe | 2026-06-01 10:11:07.387901 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-56785 |
vulnerable | 2026-07-29 01:00:29.310873 |
FlatPress - Stored Cross-Site Scripting via Unescaped Comment and Contact Form Fields
HIGH (8.2)
FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields to execute malicious scripts in browsers of viewers including administrators, or bypass URL scheme validation to inject javascript: or data: URIs.
Published: 2026-06-23T22:09:35.831Z
Updated: 2026-09-24T14:17:51.789Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-44108 |
vulnerable | 2026-06-08 07:25:10.638058 |
Details available
A stored Cross-Site Scripting (XSS) vulnerability exists in the administration panel of Flatpress CMS before 1.4 via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.
Published: 2025-05-19T00:00:00.000Z
Updated: 2025-05-19T18:22:26.514Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29602 |
vulnerable | 2026-06-08 07:14:56.514679 |
Details available
flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.
Published: 2025-05-07T00:00:00.000Z
Updated: 2025-05-08T18:31:05.649Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9847 |
vulnerable | 2026-06-08 07:00:28.793329 |
Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
HIGH (8)
FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perform the desired action on behalf of the victim user. Since the request is authenticated, the server will process it as if it were initiated by the legitimate user, effectively allowing the attacker to perform unauthorized actions. This vulnerability is fixed in version 1.4.dev.
Published: 2025-03-20T10:09:19.509Z
Updated: 2025-03-20T18:56:24.410Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-9699 |
vulnerable | 2026-06-08 07:00:28.553037 |
Cross-Site Scripting (XSS) in flatpressblog/flatpress
HIGH (7.5)
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.
Published: 2025-03-20T10:09:46.528Z
Updated: 2025-03-20T18:34:52.446Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-31835 |
vulnerable | 2026-06-08 06:35:32.150587 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25412 |
vulnerable | 2026-06-08 06:31:22.894793 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-25411 |
vulnerable | 2026-06-08 06:31:22.894239 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1148 |
vulnerable | 2026-06-08 05:52:33.942981 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1147 |
vulnerable | 2026-06-08 05:52:33.942557 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1146 |
vulnerable | 2026-06-08 05:52:33.941952 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1107 |
vulnerable | 2026-06-08 05:52:33.871922 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1106 |
vulnerable | 2026-06-08 05:52:33.871474 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1105 |
vulnerable | 2026-06-08 05:52:33.871121 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-1104 |
vulnerable | 2026-06-08 05:52:33.870683 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0947 |
vulnerable | 2026-06-08 05:52:33.495184 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4606 |
vulnerable | 2026-06-08 05:51:59.972216 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4605 |
vulnerable | 2026-06-08 05:51:59.971557 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.