Cross Site Scripting Vulnerability in FlatPress by ParagBagul
CVE-2024-33209

5.4MEDIUM

Key Information:

Vendor
Flatpress
Status
Flatpress
Vendor
CVE Published:
2 October 2024

Badges

👾 Exploit Exists🟡 Public PoC

Summary

FlatPress version 1.3 contains a vulnerability that allows for Cross Site Scripting (XSS) attacks. This flaw enables an attacker to inject harmful JavaScript code into the 'Add New Entry' section. When exploited, this could lead to arbitrary code execution within the browser context of any user who visits the compromised page, potentially endangering sensitive information and user sessions.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-33209
Created by paragbagul111

References

https://github.com/paragbagul111/CVE-2024-33209

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.