Skip to content
Noroxi

FlatPress records

36 published records for vendor flatpress.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
5.6%
Median publish → KEV
No record has entered KEV

Records by year

  1. 20
  2. 21
  3. 22
  4. 23
  5. 24
  6. 25

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

36 records
  • CVE-2022-4606
    50Plan

    PHP Remote File Inclusion in flatpressblog/flatpress

    CriticalCVSS 9.8No exploitEPSS 35%

    flatpress · flatpressDec 18, 2022

  • CVE-2023-0947
    40Plan

    Path Traversal in flatpressblog/flatpress

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    flatpress · flatpressFeb 21, 2023

  • CVE-2022-4748
    39Monitor

    FlatPress File Delete panel.mediamanager.file.php doItemActions path traversal

    CriticalCVSS 9.8No exploitEPSS 1%

    flatpress · flatpressDec 27, 2022

  • CVE-2020-22761
    35Monitor

    Cross Site Request Forgery (CSRF) vulnerability in FlatPress 1.1 via the DeleteFile function in flat/admin.php.

    HighCVSS 8.8No exploitEPSS 1%

    flatpress · flatpressJul 30, 2021

  • CVE-2024-4023
    32Monitor

    Stored XSS in flatpressblog/flatpress

    HighCVSS 8.1No exploitEPSS 1%

    flatpress · flatpressMar 20, 2025

  • CVE-2023-1105
    32Monitor

    External Control of File Name or Path in flatpressblog/flatpress

    HighCVSS 8.1No exploitEPSS 1%

    flatpress · flatpressFeb 28, 2023

  • CVE-2024-41290
    32Monitor

    FlatPress CMS v1.3.1 1.3 was discovered to use insecure methods to store authentication data via the cookie's component.

    HighCVSS 8.1Proof of conceptEPSS 0%

    flatpress · flatpressOct 2, 2024

  • CVE-2024-9847
    32Monitor

    Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress

    HighCVSS 8.0No exploitEPSS 0%

    flatpress · flatpressMar 20, 2025

  • CVE-2022-40048
    29Monitor

    Flatpress v1.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the Upload File function.

    HighCVSS 7.2No exploitEPSS 2%

    flatpress · flatpressSep 28, 2022

  • CVE-2024-25412
    24Monitor

    A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

    MediumCVSS 6.1Proof of conceptEPSS 1%

    flatpress · flatpressSep 27, 2024

  • CVE-2024-25411
    24Monitor

    A cross-site scripting (XSS) vulnerability in Flatpress v1.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload

    MediumCVSS 6.1Proof of conceptEPSS 1%

    flatpress · flatpressSep 27, 2024

  • CVE-2023-1106
    24Monitor

    Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress

    MediumCVSS 6.1No exploitEPSS 1%

    flatpress · flatpressMar 1, 2023

  • CVE-2022-4755
    24Monitor

    FlatPress Media Manager Plugin panel.mediamanager.file.php main cross site scripting

    MediumCVSS 6.1No exploitEPSS 1%

    flatpress · flatpressDec 27, 2022

  • CVE-2022-4820
    24Monitor

    FlatPress Admin Area admin.entry.list.php cross site scripting

    MediumCVSS 6.1No exploitEPSS 1%

    flatpress · flatpressDec 28, 2022

  • CVE-2022-4822
    24Monitor

    FlatPress Setup main.lib.php cross site scripting

    MediumCVSS 6.1No exploitEPSS 1%

    flatpress · flatpressDec 28, 2022

  • CVE-2022-4821
    24Monitor

    FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scripting

    MediumCVSS 6.1No exploitEPSS 1%

    flatpress · flatpressDec 28, 2022

  • CVE-2025-29602
    24Monitor

    flatpress 1.3.1 is vulnerable to Cross Site Scripting (XSS) in Administration area via Manage categories.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    flatpress · flatpressMay 7, 2025

  • CVE-2021-41432
    22Monitor

    A stored cross-site scripting (XSS) vulnerability exists in FlatPress 1.2.1 that allows for arbitrary execution of JavaScript commands throu

    MediumCVSS 5.4Proof of conceptEPSS 2%

    flatpress · flatpressJun 23, 2022

  • CVE-2022-40047
    21Monitor

    Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.p

    MediumCVSS 5.4Proof of conceptEPSS 1%

    flatpress · flatpressOct 11, 2022

  • CVE-2024-33209
    21Monitor

    FlatPress v1.3 is vulnerable to Cross Site Scripting (XSS).

    MediumCVSS 5.4Proof of conceptEPSS 1%

    flatpress · flatpressOct 2, 2024

  • CVE-2022-24588
    21Monitor

    Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.

    MediumCVSS 5.4No exploitEPSS 1%

    flatpress · flatpressFeb 15, 2022

  • CVE-2024-33210
    21Monitor

    A cross-site scripting (XSS) vulnerability has been identified in Flatpress 1.3.

    MediumCVSS 5.4Proof of conceptEPSS 1%

    flatpress · flatpressOct 2, 2024

  • CVE-2023-1104
    21Monitor

    Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

    MediumCVSS 5.4No exploitEPSS 1%

    flatpress · flatpressFeb 28, 2023

  • CVE-2022-4605
    21Monitor

    Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

    MediumCVSS 5.4No exploitEPSS 1%

    flatpress · flatpressDec 18, 2022

  • CVE-2023-1107
    21Monitor

    Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress

    MediumCVSS 5.4No exploitEPSS 1%

    flatpress · flatpressMar 1, 2023