CVE-2021-39608

HIGH

FlatCore-CMS 2.0.7 - Remote Code Execution via Upload Addon Plugin

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-39608. PoCs published by Mason Soroka-Gill.

AI-analyzed exploit summary This exploit demonstrates an authenticated RCE vulnerability in FlatCore CMS 2.0.7 by uploading a malicious PHP plugin via the admin panel. It leverages a CSRF token bypass and file upload functionality to execute arbitrary commands.

Description

Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.

Exploits (1)

exploitdb WORKING POC
by Mason Soroka-Gill · pythonwebappsphp
https://www.exploit-db.com/exploits/50262

This exploit demonstrates an authenticated RCE vulnerability in FlatCore CMS 2.0.7 by uploading a malicious PHP plugin via the admin panel. It leverages a CSRF token bypass and file upload functionality to execute arbitrary commands.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: FlatCore CMS 2.0.7
Auth required
Prerequisites: Valid admin credentials · Access to the admin panel
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (2)

Core 2
Core References
Exploit, Third Party Advisory x_refsource_misc
https://github.com/flatCore/flatCore-CMS/issues/52
Exploit, Third Party Advisory, VDB Entry x_refsource_misc
http://packetstormsecurity.com/files/164047/FlatCore-CMS-2.0.7-Remote-Code-Execution.html

Scores

CVSS v3 7.2
EPSS 0.4687
EPSS Percentile 98.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
flatcore/flatcore-cms 2.0.7
Published Aug 23, 2021
Tracked Since Feb 18, 2026