medium4.8Public exploit code
CVE-2020-35241
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting2020-09-22 · webapps · php
Impact
FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Flatpress | Flatpress | Version 1.0.3 |
Weakness classification
References
- NVD record
- CVE.org record
- https://github.com/alpernae/vulnerability-research/tree/main/CVE-2020-35241
- https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35241.md
- https://www.exploit-db.com/exploits/48826
- https://www.flatpress.org/download
- https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35241.md
- https://www.flatpress.org/download