CVE-2019-20062

The CVE-2019-20062 vulnerability affects MFScripts YetiShare versions 3.5.2 through 4.5.4, where an attacker can reset a user password by leveraging a leaked hash that does not expire until used. The available connected documents (Red Hat advisory and NVD listing) confirm the affected product ran...

CVE-2019-19735

The CVE-2019-19735 issue affects Mellow Fish YetiShare (MFScripts YetiShare) versions 3.5.2–4.5.3, specifically in class.userpeer.php. The root cause is an insecure method for generating password reset hashes based solely on microtime, enabling an attacker to brute-force the hash and set a passwo...