109 matches found
FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload
FlowiseAI Flowise version 2.2.6 and below contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. This vulnerability allows an unauthenticated attacker to upload files outside the intended directory through path traversal, potentially leading to API key exposure and...
FlowiseAI-Critical-KillChain
FlowiseAI — 중요 킬 체인 FlowiseAI = 3.0.5에 대해 인증되지 않은 계정 탈취와 원격 코드 실행이 연쇄적으로 발생합니다. 5초 이내 에 전체 컨테이너가 손상되며, 자격 증명이 전혀 필요하지 않습니다. 킬 체인 왼쪽: FlowiseAI 로그인 페이지 — 오른쪽: CVE-2025-59528을 통한 루트 셸 · uid=0root 목차 작동 방식 — 개요 취약점 세부 정보 CVE-2025-58434 — 토큰 노출 CVE-2025-59528 — 원격 코드 실행 이 연쇄 공격이 치명적인 이유 익스플로잇 코드 설명 사...
CVE-2025-58434-Flowiseai-Auth-Bypass-PoC
CVE-2025-58434 Flowiseai 인증 우회 PoC...
CVE-2025-59528-POC
CVE-2025-59528 - FlowiseAI CustomMCP 원격 코드 실행 CVSS 10.0 치명적 | 블라인드 RCE | FlowiseAI Flowise = 2.2.7-patch.1 및 = 2.2.7-patch.1, ;return 1;"...
CVE-2026-100609
creationtimestamp| type| source ---|---|--- 2026-09-28 02:38:02+00:00| seen| https://www.acn.gov.it/portale/w/flowiseai-poc-pubbliche-per-lo-sfruttamento-di-6-vulnerabilita...
CVE-2026-100608
creationtimestamp| type| source ---|---|--- 2026-09-28 02:38:02+00:00| seen| https://www.acn.gov.it/portale/w/flowiseai-poc-pubbliche-per-lo-sfruttamento-di-6-vulnerabilita...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580
FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
PT-2026-90951
Name of the Vulnerable Software and Affected Versions FlowiseAI Flowise versions prior to 3.1.3 Description A server-side request forgery SSRF exists in the Evaluations Endpoint component within the axios.post function of the packages/server/src/controllers/evaluations/index.ts file. This issue...
CVE-2026-90580: Server-Side Request Forgery (SSRF)
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
Exploit for Code Injection in Flowiseai Flowise
PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-E...
CVE-2026-73483: Improper Neutralization of Special Elements used in an OS Command
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
Exploit for Code Injection in Flowiseai Flowise
CVE-2025-59528 Educational PoC Educational use only. Th...
CVE-2026-70473
creationtimestamp| type| source ---|---|--- 2026-08-04 18:35:03+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82 2026-08-06 20:45:07+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-flowise 2026-08-10...
CVE-2026-69251
creationtimestamp| type| source ---|---|--- 2026-08-04 16:35:26+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5...
CVE-2026-69253
creationtimestamp| type| source ---|---|--- 2026-08-04 16:35:21+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp 2026-08-04 18:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbm6og5rg23...