Back to Database
Status published
High
CVE-2024-9699
Cross-Site Scripting (XSS) in flatpressblog/flatpress
Vulnerability Description
A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-9699
Credits & Attribution
No credits recorded in the NVD database.
References
More from flatpressblog
View All →CVE-2024-9847
Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress
High
8
CVE-2024-4023
Stored XSS in flatpressblog/flatpress
High
8.1
CVE-2023-1148
Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress
Medium
6.5
CVE-2023-1147
Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress
Medium
6.5
CVE-2023-1146
Cross-site Scripting (XSS) - Generic in flatpressblog/flatpress
Medium
5.4
Affected Vendor
flatpressblog
View all reports →Affected Software
flatpressblog/flatpress
Vulnerable Versions:
unspecified
Timeline
Official Publish:
March 20th, 2025
Last Modified:
March 20th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H