EIP Plus vulnerabilities

2 known vulnerabilities in EIP Plus from Hundred Plus. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.2 High severity

  EIP Plus: Unrestricted Upload of File with Dangerous Type

  CVE-2025-12867Nov 10, 2025Hundred Plus

  EIP Plus developed by Hundred Plus has an Arbitrary File Uplaod vulnerability, allowing privileged remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server.

• 9.8 Critical severity

  EIP Plus: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2025-12866Nov 10, 2025Hundred Plus

  EIP Plus developed by Hundred Plus has a Weak Password Recovery Mechanism vulnerability, allowing unauthenticated remote attacker to predict or brute-force the 'forgot password' link, thereby successfully resetting any user's password.