PT-2015-3644 · Flatpress · Flatpress

Published 2015-01-13 · Updated 2017-09-08 · CVE-2014-100036

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions FlatPress version 1.0.2

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the content parameter to the default URI.

Recommendations For FlatPress version 1.0.2, avoid using the content parameter in the default URI until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-100036

Affected Products

Flatpress

References · 5

• 🔥 https://netsparker.com/critical-xss-vulnerabilities-in-flatpress · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-100036 · Security Note
• http://secunia.com/advisories/57808 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/92538 · Note
• https://github.com/evacchi/flatpress/issues/14 · Note