Flatboard 3.2 Authenticated Stored Cross-Site Scripting via Forum Information Field

Advisories

severity: medium
date: December 11, 2025
Affecting: Flatboard 3.2
CVE: CVE-2024-58291
CWE: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
References: ExploitDB-52054
Flatboard Homepage
Credit: tmrswrr
Description: Flatboard 3.2 contains a stored cross-site scripting vulnerability that allows authenticated administrators to inject malicious scripts in forum information fields. Attackers can insert JavaScript payloads that execute when other users view the forum, potentially stealing session cookies and executing client-side scripts.