CVE-2024-9699 | THREATINT

Description

A vulnerability in the file upload functionality of the FlatPress CMS admin panel (version latest) allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting (XSS) attack if the uploaded file is accessed by other users. The issue is fixed in version 1.4.dev.

Reserved 2024-10-09 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

HIGH: 7.5CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Product status

Any version before 1.4.dev

affected

References

huntr.com/bounties/a993a05f-be50-4983-a44a-3bbff1ec00db

github.com/...ommit/f364391085334a7eae02aa2320edd6de7466ec85

cve.org (CVE-2024-9699)

nvd.nist.gov (CVE-2024-9699)

Download JSON