flatCore before 1.5.7 allows XSS by an admin via the acp/acp.php?tn=pages&sub=edit&editpage=1 page_linkname page_title page_content or page_extracontent parameter or the acp/acp.php?tn=system&sub=sys_pref prefs_pagename prefs_pagetitle or prefs_pagesubtitle parameter.