Description
Multiple cross-site scripting (XSS) vulnerabilities in FlatnuX CMS (aka Flatnuke3) 2008-12-11 allow remote attackers to inject arbitrary web script or HTML via (1) the mod parameter to the default URI; (2) the foto parameter to photo.php in the 05_Foto module; or (3) the name parameter in an insertrecord action to index.php in the 08_Files module, as demonstrated by injection within a SRC attribute of an IFRAME element.
Exploits (1)
References (7)
Core 7
Core References
Third Party Advisory third-party-advisory
x_refsource_sreason
http://securityreason.com/securityalert/4825
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/32828
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47369
Exploit vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/32826
Vendor Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/33175
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/47367
Exploit, Third Party Advisory exploit
x_refsource_exploit-db
https://www.exploit-db.com/exploits/7461
Scores
EPSS
0.0715
EPSS Percentile
91.6%
Details
CWE
CWE-79
Status
published
Products (1)
flatnux/flatnux
2008-12-11
Published
Dec 30, 2008
Tracked Since
Feb 18, 2026