105 matches found
EUVD-2025-32480
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
EUVD-2025-10669
Malicious code in bioql PyPI...
EUVD-2024-2682
Malicious code in bioql PyPI...
EUVD-2024-2594
Malicious code in bioql PyPI...
EUVD-2025-32316
Malicious code in bioql PyPI...
EUVD-2025-29246
Malicious code in bioql PyPI...
EUVD-2024-2574
Malicious code in bioql PyPI...
CVE-2025-59527 FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery SSRF vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise serve...
GHSA-HR92-4Q35-4J3M FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Summary --- A Server-Side Request Forgery SSRF vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerability allows an attacker to use the Flowise server as a proxy to access internal network web services and explore their link structures. The...
PT-2025-39072
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.6 Flowise version 3.0.5 Description A Server-Side Request Forgery SSRF vulnerability exists in the /api/v1/fetch-links endpoint of the Flowise application. This allows an attacker to use the Flowise server as a...
Flowise 安全漏洞
Flowise is a FlowiseAI open source tool for easily building LLM applications. A security vulnerability exists in Flowise that stems from user-controlled input flow to an insecure dynamic function constructor implementation that could lead to the execution of arbitrary non-sandboxed JS code in the...
PT-2025-33147
Name of the Vulnerable Software and Affected Versions: Flowise versions prior to 3.0.1 Description: Flowise, a software platform for building user interfaces over language models LLM, has a missing authentication check for a critical function. This allows remote, unauthenticated attackers to...
CVE-2024-37146
Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/credentials/id endpoint. If the default configuration is used unauthenticated, an attacker may be able to craf...
CVE-2025-29189
Flowise = 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores...
GHSA-GJX9-WG9X-7GVP Flowise Vulnerable to SQL Injection via `tableName` Parameter
Flowise = 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores...
Flowise Vulnerable to SQL Injection via `tableName` Parameter
Flowise = 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores...
CVE-2025-29189
Flowise = 2.2.3 is vulnerable to SQL Injection. via tableName parameter at PostgresVectorStores...
PT-2025-15692 · Flowise · Flowise
Name of the Vulnerable Software and Affected Versions: Flowise versions 2.2.3 and earlier Description: The issue is related to SQL Injection, which occurs via the tableName parameter at Postgres VectorStores. This allows for potential exploitation. Recommendations: For versions 2.2.3 and earlier,...
