sruupl/batflat

sruupl/batflat

Releases0

Stars138

Lightweight, fast and easy CMS for free. Bootstrap ready. https://batflat.org

Log in to subscribe

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2021-41652 ↗	Mar 1, 2022Tuesday, 1 March 2022, 23:15	7.5 HIGH	5 MEDIUM
Insecure permissions in the file database.sdb of BatFlat CMS v1.3.6 allows attackers to dump the entire database.
CVE-2021-27679 ↗	Mar 11, 2021Thursday, 11 March 2021, 17:15	5.4 MEDIUM	3.5 LOW
Cross-site scripting (XSS) vulnerability in Navigation in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27677 ↗	Mar 11, 2021Thursday, 11 March 2021, 17:15	5.4 MEDIUM	3.5 LOW
Cross-site scripting (XSS) vulnerability in Galleries in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2021-27678 ↗	Mar 11, 2021Thursday, 11 March 2021, 17:15	5.4 MEDIUM	3.5 LOW
Cross-site scripting (XSS) vulnerability in Snippets in Batflat CMS 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the field name.
CVE-2020-35734 ↗	Feb 15, 2021Monday, 15 February 2021, 21:15	7.2 HIGH	6.5 MEDIUM
Sruu.pl in Batflat 1.3.6 allows an authenticated user to perform code injection (and consequently Remote Code Execution) via the input fields of the Users tab. To exploit this, one must login to the administration panel and edit an arbitrary user's data (username, displayed name, etc.). NOTE: This vulnerability only affects products that are no longer supported by the maintainer