CVE-2021-23838

An issue was discovered in flatCore before 2.0.0 build 139. A reflected XSS vulnerability was identified in the media_filter HTTP request body parameter for the acp interface. The affected parameter accepts malicious client-side script without proper input sanitization. For example, a malicious user can leverage this vulnerability to steal cookies from a victim user and perform a session-hijacking attack, which may then lead to unauthorized access to the site.

• CWE-79

• http://packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/flatCore/flatCore-CMSProduct, Third Party Advisory
• https://sec-consult.com/vulnerability-lab/Third Party Advisory
• http://packetstormsecurity.com/files/160936/flatCore-CMS-XSS-File-Disclosure-SQL-Injection.htmlExploit, Third Party Advisory, VDB Entry
• https://github.com/flatCore/flatCore-CMSProduct, Third Party Advisory
• https://sec-consult.com/vulnerability-lab/Third Party Advisory

Published

Jan 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-23824This affects the package Crow before 0.3+4. When using attri…6.1
• CVE-2021-23827Keybase Desktop Client before 5.6.0 on Windows and macOS, an…5.5
• CVE-2021-2383Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23835An issue was discovered in flatCore before 2.0.0 build 139. …4.9
• CVE-2021-23836An issue was discovered in flatCore before 2.0.0 build 139. …4.8
• CVE-2021-23837An issue was discovered in flatCore before 2.0.0 build 139. …6.5
• CVE-2021-23839OpenSSL 1.0.2 supports SSLv2. If a client attempts to negoti…3.7
• CVE-2021-2384Vulnerability in the MySQL Server product of Oracle MySQL (c…4.9
• CVE-2021-23840Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_Decrypt…7.5
• CVE-2021-23841The OpenSSL public API function X509_issuer_and_serial_hash(…5.9
• CVE-2021-23842Communication to the AMC2 uses a state-of-the-art cryptograp…7.1
• CVE-2021-23843The Bosch software tools AccessIPConfig.exe and AmcIpConfig.…7.8