Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23836PUBLISHED: 2021-01-15
An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The...
CVE-2021-23837PUBLISHED: 2021-01-15
An issue was discovered in flatCore before 2.0.0 build 139. A time-based blind SQL injection was identified in the selected_folder HTTP request body parameter for the acp interface. The affected parameter (which retrieves the file contents of the specified folder) was found to be accepting malicious...
CVE-2021-23838PUBLISHED: 2021-01-15
An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious user...
CVE-2020-35581PUBLISHED: 2021-01-15A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/admin-ajax.php request with the meta[title] parameter.
CVE-2020-35582PUBLISHED: 2021-01-15A stored cross-site scripting (XSS) issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the post_title parameter.
User Rank: Ninja
1/24/2018 | 9:48:30 PM
But, of course, for all anyone knows, the vulnerability has already been exploited in the wild (and, if so, very possibly even by nation-state actors, who would probably be the best poised to have known about the vulnerability and have done so -- especially without you finding out about it).
Sure, good coordination has to go into vulnerabilty announcements and patch processes, but because this particular vulnerability is so disastrous and severe, it would be hard for much of the population to not take a Chicken Little approach here. It's a pretty bad vulnerability.