CVE-2025-0984

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-0984
Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection.This issue affects E-Flow: before 3.23.00.

8.2 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 5.3

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact LOW

Scope CHANGED

References
Link Resource
https://netoloji.com/yazilim-surum-notlari/
https://www.usom.gov.tr/bildirim/tr-25-0102
Configurations

No configuration.

History

07 May 2025, 14:13

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de carga sin restricciones de archivos con tipo peligroso y neutralización incorrecta de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en Netoloji Software E-Flow permite acceder a funcionalidades que no están correctamente restringidas por ACL, XSS almacenado e inyección de contenido de archivos. Este problema afecta a E-Flow: antes de 3.23.00.

06 May 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-05-06 12:15

Updated : 2025-05-07 14:13

NVD link : CVE-2025-0984

Mitre link : CVE-2025-0984

CVE.ORG link : CVE-2025-0984

JSON object : View

Products Affected

No product.

CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-434

Unrestricted Upload of File with Dangerous Type