PT-2025-7772 · Flatpress · Flatpress

Athul S · Published 2025-02-24 · Updated 2025-02-24 · CVE-2025-25460

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions FlatPress version 1.3.1

Description A stored Cross-Site Scripting issue was identified within the "Add Entry" feature, allowing authenticated attackers to inject malicious JavaScript payloads into blog posts. This is executed when other users view the posts due to improper input sanitization of the TextArea field in the blog entry submission form.

Recommendations For FlatPress version 1.3.1, ensure proper input sanitization of the TextArea field in the blog entry submission form to prevent malicious JavaScript injections. As a temporary workaround, consider restricting access to the "Add Entry" feature until a fix is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-25460

Affected Products

Flatpress

References · 6

• 🔥 https://github.com/RoNiXxCybSeC0101/CVE-2025-25460 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-25460 · Security Note
• https://osv.dev/vulnerability/CVE-2025-25460 · Vendor Advisory
• https://github.com/flatpressblog/flatpress · Note
• https://twitter.com/CVEnew/status/1894059292182921481 · Twitter Post
• https://t.me/cvedetector/18797 · Telegram Post