CVE-2020-18698

The CVE-2020-18698 entry concerns Lin-CMS-Flask v0.1.1 with an improper authentication flaw in the login path (component app/api/cms/user.py). The vulnerability enables remote brute-force login attempts without restriction. NVD/mitigations indicate an extremely high impact under CVSS-3.1: User au...

CVE-2020-18701

CVE-2020-18701 affects Lin-CMS-Flask v0.1.1, where incorrect access control fails to invalidate a user’s authentication token on logout, enabling replay of packets to obtain sensitive information and/or gain privileges. Affected component is the authentication/session handling in Lin-CMS-Flask (v...

CVE-2020-18699

CVE-2020-18699 describes a Cross Site Scripting (XSS) issue in Lin-CMS-Flask v0.1.1. The vulnerability is triggered via input in the Username parameter of the component path app/api/cms/user.py, allowing remote attackers to execute arbitrary code within the context of the affected application. Th...