Skip to content
Fencer Vulns
high 8.0

CVE-2024-9847 json

Cross-Site Request Forgery (CSRF) in flatpressblog/flatpress

published 2025-03-20 19 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-6812

cvss
8.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

FlatPress CMS version latest is vulnerable to Cross-Site Request Forgery (CSRF) attacks that allow an attacker to enable or disable plugins on behalf of a victim user. The attacker can craft a malicious link or script that, when clicked by an authenticated user, will send a request to the FlatPress CMS server to perform the desired action on behalf of the victim user. Since the request is authenticated, the server will process it as if it were initiated by the legitimate user, effectively allowing the attacker to perform unauthorized actions. This vulnerability is fixed in version 1.4.dev.

Patch / fix

  • flatpressblog flatpressblog/flatpress 1.4.dev

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
19 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/b30ef7b0-74ea-4cac-adc4-1cc8a5cb559e referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 8.0 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected products

  • flatpressblog flatpressblog/flatpress

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.