Privilege Escalation due to Blind NoSQL Injection in flintcms

Description

Versions of flintcms before version 1.1.10 are vulnerable to account takeover due to blind MongoDB injection in the password reset.

Recommendation

Update the flintcms package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.1.10
• Patched version(s): 1.1.10

References

• GHSA-jhq3-57xh-6643
• hackerone.com
• www.npmjs.com
• CVE-2018-3783
• CWE-89
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• @digitalocean/do-markdownit has Type Confusion vulnerability - CVE-2025-59717
• node-opcua-alarm-condition prototype pollution vulnerability - CVE-2024-57086
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• axios Inefficient Regular Expression Complexity vulnerability - CVE-2021-3749

Tags:

npm

flintcms