Skip to content
OpenAdvisories

Vendor

flextype

4 known vulnerabilities.

Products

flextype 4
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.2
    CVE-2026-89145

    Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory

    Flextype CMS versions 0.9.9 through 1.0.0-alpha.3 fail to HTML-escape plugin directory names in the dependency error page rendered by getValidPluginsDependencies(). Attackers with write access to the plugins directory can create a plugin with HTML characters …

    flextype flextype
  • Medium 5.9
    CVE-2026-88897

    Flextype CMS through 1.0.0-alpha.3 API Token Exposure via Query String

    Flextype CMS through 1.0.0-alpha.3 accepts API authentication credentials through URL query string parameters in REST API routes. Attackers with access to web server, proxy, or monitoring logs can recover valid API token pairs that grant full API access.

    flextype flextype
  • Medium 6.5
    CVE-2026-77939

    Flextype CMS 1.0.0-dev RCE via POST /api/v1/query Endpoint

    Flextype CMS through v1.0.0-dev contains an expression language injection vulnerability that allows authenticated attackers with a valid API token to read arbitrary files by passing unsanitized user-supplied input to the Symfony ExpressionLanguage engine via …

    flextype flextype