PT-2025-23664 · Unknown · Enilu Web-Flash

Name of the Vulnerable Software and Affected Versions: enilu web-flash version 1.0 Description: A problematic vulnerability has been found in the File Upload component of enilu web-flash. This issue affects the fileService.upload function, allowing for cross-site scripting through the manipulatio...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

CVE-2024-28270

An issue in web-flash v3.0 , an open-source web system based on Spring Boot and Vue.js, allows an attacker to reset passwords for arbitrary users. This is caused by a vulnerability reachable via a crafted POST request to the /prod-api/user/resetPassword endpoint. To mitigate this risk, it is reco...