CVE-2025-5523

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A vulnerability classified as problematic has been found in enilu web-flash 1.0. This affects the function fileService.upload of the file src/main/java/cn/enilu/flash/api/controller/FileController/upload of the component File Upload. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-94

Affected software

Vendor	Product	Versions
enilu	web-flash	1.0

References

https://gitee.com/enilu/web-flash/issues/ICAXTMExploit, Issue Tracking
https://vuldb.com/?ctiid.310959Permissions Required, VDB Entry
https://vuldb.com/?id.310959Third Party Advisory, VDB Entry
https://vuldb.com/?submit.585342Third Party Advisory, VDB Entry
https://gitee.com/enilu/web-flash/issues/ICAXTMExploit, Issue Tracking

Timeline

Published: Jun 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-552307.8Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.CVE-2025-552317.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an unauthorized attack CVE-2025-552329.8Deserialization of untrusted data in Microsoft High Performance Compute Pack (HPC) allows an unauthorized attacker to execute code over a ne CVE-2025-552337.8Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally.CVE-2025-552349.8SMB Server might be susceptible to relay attacks depending on the configuration. An attacker who successfully exploited these vulnerabilitie CVE-2025-552367.8Time-of-check time-of-use (toctou) race condition in Graphics Kernel allows an authorized attacker to execute code locally.CVE-2025-552387.5Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability CVE-2025-55244.9The OceanWP theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Select HTML tag in all versions up to, and including, 4 CVE-2025-552407.3Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally.CVE-2025-5524110.0Azure Entra ID Elevation of Privilege Vulnerability CVE-2025-552427.5Exposure of sensitive information to an unauthorized actor in Xbox allows an unauthorized attacker to disclose information over a network.CVE-2025-552437.5Exposure of sensitive information to an unauthorized actor in Microsoft Office Plus allows an unauthorized attacker to perform spoofing over