PT-2025-23664 · Unknown · Enilu Web-Flash

Name of the Vulnerable Software and Affected Versions: enilu web-flash version 1.0 Description: A problematic vulnerability has been found in the File Upload component of enilu web-flash. This issue affects the fileService.upload function, allowing for cross-site scripting through the manipulatio...

CVE-2024-28270

An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resetPassword...

CVE-2024-28270

CVE-2024-28270 affects web-flash v3.0. A vulnerability allows an attacker to reset passwords for arbitrary users by sending a crafted POST request to /prod-api/user/resetPassword. CVSS v3.1 base score 8.1 (HIGH); attack vector NETWORK, complexity LOW, privileges LOW, user interaction NONE, with c...