Description
A privilege escalation detected in flintcms versions <= 1.1.9 allows account takeover due to blind MongoDB injection in password reset.
Remediation
References
https://hackerone.com/reports/386807
Related Vulnerabilities
CVE-2019-12043 Vulnerability in npm package remarkable
CVE-2020-23849 Vulnerability in npm package jsoneditor
CVE-2023-40350 Vulnerability in maven package org.jenkins-ci.plugins:docker-swarm
CVE-2016-10531 Vulnerability in maven package org.webjars:marked
CVE-2017-16008 Vulnerability in maven package org.webjars.npm:i18next