Flatpress 漏洞列表

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks.

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can possibly steal cookie-based authentication credentials and launch other attacks.

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

Path Traversal in GitHub repository flatpressblog/flatpress prior to 1.3.

FlatPress 1.2.1 contains a stored cross-site scripting vulnerability that allows for arbitrary execution of JavaScript commands through blog content. An attacker can steal cookie-based authentication credentials and launch other attacks. Note: this is similar to CVE-2021-41432, however this attack uses the "page" parameter.

FlatPress存在存储型跨站脚本漏洞。此漏洞是由于对用户输入的content参数的验证不当导致的。

FlatPress是FlatPress社区的一个基于Php无需数据库支持的博客建站系统。 FlatPress1.3之前版本存在路径遍历漏洞，攻击者利用该漏洞可以进行路径遍历。