CVE-2021-23836

An issue was discovered in flatCore before 2.0.0 build 139. A stored XSS vulnerability was identified in the prefs_smtp_psw HTTP request body parameter for the acp interface. An admin user can inject malicious client-side script into the affected parameter without any form of input sanitization. The injected payload will be executed in the browser of a user whenever one visits the affected module page.

• CWE-79

• http://packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/flatCore/flatCore-CMSProduct, Third Party Advisory
• https://sec-consult.com/vulnerability-lab/Third Party Advisory
• http://packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/flatCore/flatCore-CMSProduct, Third Party Advisory
• https://sec-consult.com/vulnerability-lab/Third Party Advisory

Published

Jan 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2382Vulnerability in the Oracle WebLogic Server product of Oracl…9.8
• CVE-2021-23820This affects all versions of package json-pointer. A type co…9.8
• CVE-2021-23824This affects the package Crow before 0.3+4. When using attri…6.1
• CVE-2021-23827Keybase Desktop Client before 5.6.0 on Windows and macOS, an…5.5
• CVE-2021-2383Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23835An issue was discovered in flatCore before 2.0.0 build 139. …4.9
• CVE-2021-23837An issue was discovered in flatCore before 2.0.0 build 139. …6.5
• CVE-2021-23838An issue was discovered in flatCore before 2.0.0 build 139. …4.8
• CVE-2021-23839OpenSSL 1.0.2 supports SSLv2. If a client attempts to negoti…3.7
• CVE-2021-2384Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23840Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_Decrypt…7.5
• CVE-2021-23841The OpenSSL public API function X509_issuer_and_serial_hash(…5.9