HighCVSS 7.5
EPSS 6.1%
Flatnuke 3 (aka FlatnuX) allows remote attackers to obtain administrative access via a myforum%00 cookie.
Vendor
flatnuke3 vulnerabilities
4 published CVES affecting flatnuke3, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 4
- Critical
- 0
- High
- 1
- Medium
- 3
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
Latest flatnuke3 CVEs
Newest publication first
-
-
MediumCVSS 6.0 EPSS 3.8%
Direct static code injection vulnerability in the download module in Flatnuke 3 allows remote authenticated administrators to inject arbitrary PHP code into a description.it.php file in a subdirectory of Download/ by saving a description and setting fneditmode to 1. NOTE: unauthe...
-
MediumCVSS 4.3 EPSS 0.88%
Cross-site request forgery (CSRF) vulnerability in index.php in the File Manager module in Flatnuke 3 allows remote attackers to perform certain actions as administrators via requests containing the pathname in the dir parameter and the filename in the ffile parameter.
-
MediumCVSS 5.0 EPSS 2.6%
index.php in the File Manager module in Flatnuke 3 allows remote attackers to obtain sensitive information via an invalid argumentname parameter in a disc op action, which reveals the path in an error message.
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.