enilu records

2 published records for vendor enilu.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Pre-auth RCE: flaws that let an attacker run code over the network without an account. Median publish → KEV: the typical time between a record being published and CISA listing it as exploited.

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

XSS 1

All records

2 records

CVE records
Action	CVE	Vulnerability	Severity	EPSS · Published
32Monitor	CVE-2024-28270No exploit	An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/resCWE-261	High8.1	0.4%Apr 8, 2024
20Monitor	CVE-2025-5523No exploit	enilu web-flash File Upload upload fileService.upload cross site scriptingenilu · web-flash · CWE-79 XSS	Medium5.1	0.3%Jun 3, 2025

CVE-2024-28270
32Monitor
An issue discovered in web-flash v3.0 allows attackers to reset passwords for arbitrary users via crafted POST request to /prod-api/user/res
HighCVSS 8.1No exploitEPSS 0%
Apr 8, 2024
CVE-2025-5523
20Monitor
enilu web-flash File Upload upload fileService.upload cross site scripting
MediumCVSS 5.1No exploitEPSS 0%
- XSS
enilu · web-flashJun 3, 2025