973 matches found
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change
Summary Bypass of Password Confirmation - Unverified Password Change authenticated change without current password An authenticated user is allowed to change their account password without supplying the current password or any additional verification. The application does not verify the actor’s...
Unverified Password Change
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Unverified Password Change via the profile update process. An attacker can gain unauthorized access to user accounts by changing the email address associated with an account without additional verification...
Unverified Password Change
Overview flowise-ui is a Affected versions of this package are vulnerable to Unverified Password Change via the profile update process. An attacker can gain unauthorized access to user accounts by changing the email address associated with an account without additional verification steps. Note:...
flowise (>=1.6.1 <=2.2.8), flowise-birat (>=1.0.0 <=1.2.5) +2 more potentially affected by unknown CVE via flowise-ui (>=1.8.4 <=2.2.8)
flowise-ui NPM version =1.8.4, =1.6.1, =1.0.0, =0.0.1, =0.0.2, =0.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-X39M-3393-3QP4...
EUVD-2025-197619
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change credentials...
GHSA-X39M-3393-3QP4 Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)
Summary Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change The application allows changing the account email address used as a login identifier and/or password recovery address without verifying the requester’s authority to make that change no...
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)
Summary Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change The application allows changing the account email address used as a login identifier and/or password recovery address without verifying the requester’s authority to make that change no...
Insufficient Session Expiration
Overview flowise-ui is a Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate active session tokens after a password change. An attacker can maintain unauthorized access by continuing to use a previously established session even afte...
EUVD-2025-197620
Flowise Fails to Invalidate Existing Sessions After Password Changes...
Insufficient Session Expiration
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate active session tokens after a password change. An attacker can maintain unauthorized access by continuing to use a previously established...
📄 Flowise 3.0.4 Remote Command Execution
Flowise versions prior to 3.0.5 suffer from a remote command execution vulnerability. Exploit Title: Flowise 3.0.4 - Remote Code Execution RCE Date: 10/11/2025 Exploit Author: nltt0 https://github.com/nltt-br Vendor Homepage: https://flowiseai.com/ Software Link:...
Exploit for Code Injection in Flowiseai Flowise
CVE-2025-59528.yaml Flowise is a drag & drop user interface to...
Improper Authentication
flowise is vulnerable to Improper Authentication. The vulnerability is due to minimal authentication and lack of role-based access controls RBAC, followed by the default installation operating without authentication unless explicitly configured, which allows an attacker to execute unauthorized OS...
Flowise 3.0.4 - Remote Code Execution (RCE)
Exploit Title: Flowise 3.0.4 - Remote Code Execution RCE Date: 10/11/2025 Exploit Author: nltt0 https://github.com/nltt-br Vendor Homepage: https://flowiseai.com/ Software Link: https://github.com/FlowiseAI/Flowise Version: 3.0.5 CVE: CVE-2025-59528 from requests import post, session from argpars...
PT-2025-44570
Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.8.2 @remix-run/react versions 1.15.0 through 2.17.0 Description A cross-site scripting XSS issue exists in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags. This could allow...
PT-2025-44571
Name of the Vulnerable Software and Affected Versions React Router versions 7.0.0 through 7.9.3 @remix-run/deno versions prior to 2.17.2 @remix-run/node versions prior to 2.17.2 Description The issue concerns a path traversal flaw in React Router and Remix when using the createFileSessionStorage...
Remote Code Execution (RCE)
Flowise is vulnerable to remote code execution RCE. The vulnerability is due to unsanitized evaluation of user input in the “Supabase RPC Filter” field, which allows an attacker to execute arbitrary code on the affected system...
Server-Side Request Forgery (SSRF)
Flowise is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of user-supplied URLs in the /api/v1/fetch-links endpoint, which allows an attacker to exploit the server as a proxy to access internal network resources and explore their link structures...
Flowise File Upload Vulnerability (CNVD-2025-24788)
Flowise is a FlowiseAI open source tool for easily building LLM applications. A file upload vulnerability exists in Flowise version 3.0.7, which stems from a file upload process that does not validate the file extension, MIME type, or file content, and can be exploited by an attacker to cause...
