Privilege Escalation due to Blind NoSQL Injection in flintcms

Description

Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset.

Recommendation

Update the flintcms package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.10
• Patched version(s): 1.1.10

References

• GHSA-jhq3-57xh-6643
• hackerone.com
• www.npmjs.com
• CVE-2018-3783
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Signal K Server: Privilege Escalation by Admin Role Injection via /enableSecurity - CVE-2026-33950
• auth0-js Privilege Escalation Vulnerability - CVE-2017-17068
• mongosh vulnerable to local privilege escalation - CVE-2025-1756
• Code Injection in cryo - CVE-2018-3784

You might also like:

How do hackers hack websites?

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

flintcms