PT-2025-19873 · Netoloji · Netoloji Software E-Flow

Ali Kazar · Published 2025-05-06 · Updated 2025-05-06 · CVE-2025-0984

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Netoloji Software E-Flow versions prior to 3.23.00

Description The issue affects Netoloji Software E-Flow, allowing unrestricted upload of files with dangerous types and improper neutralization of input during web page generation, which can lead to Stored XSS and File Content Injection. This can enable accessing functionality not properly constrained by ACLs.

Recommendations For versions prior to 3.23.00, update to version 3.23.00 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only allow safe file types and disabling any functionality that allows uploading files with dangerous types until a patch is available. Restrict access to sensitive areas of the application to minimize the risk of exploitation.

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2025-0984

Affected Products

Netoloji Software E-Flow

References · 6

• https://netoloji.com/yazilim-surum-notlari · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-0984 · Security Note
• https://usom.gov.tr/bildirim/tr-25-0102 · Note
• https://t.me/cvetracker/23167 · Telegram Post
• https://twitter.com/CVEnew/status/1919718369756119279 · Twitter Post
• https://t.me/cvedetector/24608 · Telegram Post