flatpressblog/flatpress vulnerabilities

2 known vulnerabilities in flatpressblog/flatpress from Flatpressblog. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.0 High severity

  flatpressblog/flatpress: Cross-Site Request Forgery

  CVE-2024-9847Mar 20, 2025Flatpressblog

  FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated use

• 8.1 High severity

  flatpressblog/flatpress: Improper Neutralization of Input During Web Page Generation

  CVE-2024-4023Mar 20, 2025Flatpressblog

  A stored cross-site scripting (XSS) vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a `.xsig` extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading t