CVE-2025-0984 | THREATINT

Description

Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Netoloji Software E-Flow allows Accessing Functionality Not Properly Constrained by ACLs, Stored XSS, File Content Injection.This issue affects E-Flow: before 3.23.00.

Reserved 2025-02-03 | Published 2025-05-06 | Updated 2025-05-06 | Assigner TR-CERT

HIGH: 8.2CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

Problem types

CWE-434 Unrestricted Upload of File with Dangerous Type

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status

unaffected

Any version before 3.23.00

affected

Credits

Ali KAZAR finder

References

netoloji.com/yazilim-surum-notlari/ vendor-advisory

www.usom.gov.tr/bildirim/tr-25-0102 third-party-advisory

cve.org (CVE-2025-0984)

nvd.nist.gov (CVE-2025-0984)

Download JSON