CVE-2022-4821

FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scripting

2.4 Low

A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: High
User interaction: Required

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.56%Down 0.4 points since Dec 29, 2022

What each source reports

CVE List Score used 2.4

FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scripting

Record: CVE-2022-4821
CVSS 3.1: 2.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS 3.0: 2.4 LowCVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2022-52098 2.4

Record: EUVD-2022-52098
CVSS 3.1: 2.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Updated: 2026-11-03

GitHub AdvisoriesGHSA-gpvj-w4qp-hf4h 6.1

A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the...

Record: GHSA-gpvj-w4qp-hf4h
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

NVD 2.4

Record: CVE-2022-4821
CVSS 3.1: 2.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 2.4

FlatPress XML File Handler/MD File admin.uploader.php onupload cross site scripting

Record: CVE-2022-4821
CVSS 3.1: 2.4 LowCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

Affected products

flatpress

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-4821 is a low vulnerability (CVSS 2.4) in Flatpress, published December 28, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.56%, the 46th percentile. No source names a fixed version.