CVE-2025-29192

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...

CVE-2025-50538

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...

CVE-2025-50538

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...

PT-2025-40860

Name of the Vulnerable Software and Affected Versions Affected versions not specified Description An API endpoint allows the creation of arbitrary log entries via a POST request. Insufficient validation of input data enables an attacker to create manipulated log entries, potentially falsifying or...

CVE-2025-58580: Improper Output Neutralization for Logs

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example...

CVE-2025-50538: Improper Neutralization of Input During Web Page Generation

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...

CVE-2025-29192: Improper Neutralization of Input During Web Page Generation

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...

CVE-2025-59447: Exposure of Sensitive System Information to an Unauthorized Control Sphere

The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...

CVE-2025-29192

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...

EUVD-2025-32480

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...

CVE-2025-50538

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...

EUVD-2025-32481

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log...

SillyTavern security vulnerabilities

SillyTavern is an open source front-end interface for a large language model from SillyTavern. A security vulnerability exists in SillyTavern versions prior to 1.13.4, which stems from vulnerability to DNS rebinding attacks that could lead to the installation of malicious extensions, reading chat...

SICK AG Enterprise Analytics security vulnerabilities

SICK AG Enterprise Analytics is a package analysis software from SICK AG, Germany. A security vulnerability exists in SICK AG Enterprise Analytics that stems from unvalidated POST request data that could result in logging of jumbo payloads...

SICK AG Enterprise Analytics security vulnerabilities

SICK AG Enterprise Analytics is a package analytics software from SICK AG, Germany. A security vulnerability exists in SICK AG Enterprise Analytics that stems from an API endpoint that does not adequately validate input data, which could lead to altered or diluted log entries...

Microsoft Windows Privilege Escalation Vulnerability

Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms...

CVE-2025-29192

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...

CVE-2025-29192

FlowiseAI Flowise prior to 3.0.5 is vulnerable to Cross-Site Scripting (XSS) via FORM and INPUT elements in the chat log when viewed by an admin. The issue is consistently described across sources as a stored XSS variant introduced by insufficient sanitization of chat-log form fields. Affected so...

EUVD-2025-32535

A stored cross-site scripting XSS vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 - System version 2.5.26, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payloa...

CVE-2025-58582: Allocation of Resources Without Limits or Throttling

If a user tries to login but the provided credentials are incorrect a log is created. The data for this POST requests is not validated and it’s possible to send giant payloads which are then logged...