EUVD-2018-0407

Malware in sbrugna...

Privilege Escalation due to Blind NoSQL Injection in flintcms

Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later...

GHSA-JHQ3-57XH-6643 Privilege Escalation due to Blind NoSQL Injection in flintcms

Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset. Recommendation Update to version 1.1.10 or later...

Flintcms Privilege Vulnerability

flintcms is a content management system CMS. A power-lifting vulnerability exists in flintcms 1.1.9 and earlier versions. An attacker can exploit this vulnerability to compromise an account...

Design/Logic Flaw

A privilege escalation detected in flintcms versions = 1.1.9 allows account takeover due to blind MongoDB injection in password reset...

CVE-2018-3783

A privilege escalation detected in flintcms versions = 1.1.9 allows account takeover due to blind MongoDB injection in password reset...

CVE-2018-3783

A privilege escalation detected in flintcms versions = 1.1.9 allows account takeover due to blind MongoDB injection in password reset...

CVE-2018-3783

A privilege escalation detected in flintcms versions = 1.1.9 allows account takeover due to blind MongoDB injection in password reset...

CVE-2018-3783

CVE-2018-3783 applies to FlintCMS. Several advisories confirm a privilege escalation vulnerability in FlintCMS versions

Query Injection

flintcms is vulnerable to privilege escalation attacks. The library does not sanitize user input, allowing a malicious user to inject and execute arbitrary MongoDB queries through the password reset page...

Node.js third-party modules: [flintcms] Account takeover due to blind MongoDB injection in password reset

I would like to report a privilege escalation vulnerability in flintcms. It allows to reset a known user password, extract its password reset token and reset its password to then access the account. Module module name: flintcms version: v.1.1.9 npm page: https://www.npmjs.com/package/flintcms...