PT-2025-21942 · Unknown · Flatpress Cms

Harish0X · Published 2025-05-19 · Updated 2025-06-12 · CVE-2025-44108

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Flatpress CMS versions prior to 1.4

Description: A stored Cross-Site Scripting (XSS) issue exists in the administration panel of Flatpress CMS via the gallery captions component. An attacker with admin privileges can inject a malicious JavaScript payload into the system, which is then stored persistently.

Recommendations: For versions prior to 1.4, update to version 1.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the administration panel and the gallery captions component to minimize the risk of exploitation. Avoid using the gallery captions component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-44108

Affected Products

Flatpress Cms

References · 8

• 🔥 https://harish0x.github.io/blog/CVE-2025-44108 · Exploit
• https://github.com/flatpressblog/flatpress/commit/24a6feacf1747ec19725b52c097715c8ab9c4559 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-44108 · Security Note
• https://osv.dev/vulnerability/CVE-2025-44108 · Vendor Advisory
• https://github.com/flatpressblog/flatpress/releases/tag/1.3.1 · Note
• https://github.com/flatpressblog/flatpress/releases/tag/1.4.rc2 · Note
• https://twitter.com/dailycve/status/1933223500397097127 · Twitter Post
• https://twitter.com/CVEnew/status/1924469164346925120 · Twitter Post