CVE-2020-17451

flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname, page_title, page_content, or page_extracontent parameter, or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename, prefs_pagetitle, or prefs_pagesubtitle parameter.

• CWE-79

• https://lists.openwall.net/full-disclosure/2020/08/07/1Exploit, Mailing List, Third Party Advisory
• https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-cms/Exploit, Third Party Advisory
• https://lists.openwall.net/full-disclosure/2020/08/07/1Exploit, Mailing List, Third Party Advisory
• https://sec-consult.com/en/blog/advisories/multiple-vulnerabilities-in-flatcore-cms/Exploit, Third Party Advisory

Published

Aug 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17446asyncpg before 0.21.0 allows a malicious PostgreSQL server t…9.8
• CVE-2020-17447Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2020-17448Telegram Desktop through 2.1.13 allows a spoofed file type t…7.8
• CVE-2020-17449PHP-Fusion 9.03 allows XSS via the error_log file.5.4
• CVE-2020-1745A file inclusion vulnerability was found in the AJP connecto…9.8
• CVE-2020-17450PHP-Fusion 9.03 allows XSS on the preview page.6.1
• CVE-2020-17452flatCore before 1.5.7 allows upload and execution of a .php …7.2
• CVE-2020-17453WSO2 Management Console through 5.10 allows XSS via the carb…6.1
• CVE-2020-17454WSO2 API Manager 3.1.0 and earlier has reflected XSS on the …6.1
• CVE-2020-17456SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code…9.8
• CVE-2020-17457Fujitsu ServerView Suite iRMC before 9.62F allows XSS. An au…5.4
• CVE-2020-17458A post-authenticated stored XSS was found in MultiUx v.3.1.1…5.4