9712 matches found
Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
GHSA-WQ95-WR7M-26H4 Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
PT-2025-40944
Name of the Vulnerable Software and Affected Versions YoSmart YoLink Smart Hub device 0382 Description The device exposes a UART debug interface. An attacker with direct physical access can use this interface to read a boot log, which contains network access credentials. Recommendations At the...
CVE-2025-59447
The YoSmart YoLink Smart Hub device 0382 exposes a UART debug interface. An attacker with direct physical access can leverage this interface to read a boot log, which includes network access credentials...
ROS-20251006-06
A vulnerability in the AbuseFilter extension for MediaWiki is related to the fact that an API caller can map a filter condition with AbuseFilter logs. Exploiting the vulnerability could allow an attacker, acting remotely, to gain access to sensitive information...
PT-2025-40898
Name of the Vulnerable Software and Affected Versions Optimod versions 1.0.0.33 and 2.5.26 Optimod 5950 Optimod 5950HD Optimod 5750 Optimod 5750HD Optimod Trio Description A stored cross-site scripting XSS issue exists in Optimod audio processors. This allows a remote attacker to execute arbitrar...
EUVD-2025-32535
A stored cross-site scripting XSS vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 - System version 2.5.26, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payloa...
PT-2025-40864
Name of the Vulnerable Software and Affected Versions affected versions not specified Description The username and password are sent directly in the URL as parameters within HTTP requests. This practice poses a significant risk of sensitive data disclosure, as URLs may be stored in server logs,...
CVE-2025-61198
A stored cross-site scripting XSS vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 - System version 2.5.26, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payloa...
CVE-2025-59447
Affected product/versions. YoSmart YoLink Smart Hub device 0382 is affected. The root cause is exposure of a UART debug interface. Impact. An attacker with direct physical access can read a boot log that includes network access credentials, leading to potential credential disclosure. Exploitation...
CVE-2025-61198
A stored cross-site scripting XSS vulnerability in Optimod 5950 - Optimod 5950HD - Optimod 5750 - Optimod 5750HD - Optimod Trio - Optimod version 1.0.0.33 - System version 2.5.26, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payloa...
CVE-2025-61198
CVE-2025-61198 is a stored XSS in Orban Optimod devices (5950/5950HD/5750/5750HD/Trio) affecting Optimod 1.0.0.33 and System 2.5.26. The vulnerability arises from injecting a malicious payload into logs that are rendered in the UI, allowing an attacker to execute arbitrary JavaScript in a user’s ...
BIT-MONGODB-2025-6711 Incomplete Redaction of Sensitive Information in MongoDB Server Logs
An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered. This issue affects MongoDB Server v8.0 versions prior to 8.0.5, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v6.0...
Cross-site Scripting (XSS)
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Cross-site Scripting XSS via the chat logs, due to improper input sanitization. An attacker can access sensitive information or impersonate an administrator by injecting malicious HTML or scripts into chat...
Flowise Stored XSS vulnerability through logs in chatbot
Description In the chat log, tags like input and form are allowed. This makes a potential vulnerability where an attacker could inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive...
GHSA-7R4H-VMJ9-WG42 Flowise Stored XSS vulnerability through logs in chatbot
Description In the chat log, tags like input and form are allowed. This makes a potential vulnerability where an attacker could inject malicious HTML into the log via prompts. When an admin views the log containing the malicious HTML, the attacker could steal the admin's credentials or sensitive...
EUVD-2025-13100
Malicious code in bioql PyPI...
EUVD-2023-35730
Malicious code in bioql PyPI...