CVE-2025-5523

enilu web-flash File Upload upload fileService.upload cross site scripting

CVSS 5.1 MEDIUMEPSS 0.3%CWE-79 CWE-94

Vexday Risk Score

13Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 5.1EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

03 jun 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Produtos afetados

enilu · web-flash

Referências

https://gitee.com/enilu/web-flash/issues/ICAXTM https://vuldb.com/?ctiid.310959 https://vuldb.com/?id.310959 https://vuldb.com/?submit.585342