CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

7934 matches found

CVE•added 2025/10/06 12:00 a.m.•30 views

CVE-2025-50538

Flowise before version 3.0.5 is affected by an XSS vulnerability where an unfiltered IFRAME element allows an attacker to inject scripts when an admin views the chat log. Affected product: Flowise (FlowiseAI) prior to 3.0.5. Root cause: unfiltered IFRAME in the chat log view, enabling cross-site ...

8.2CVSS5.8AI score0.13138EPSS

SaveExploits1References3Affected Software1

Positive Technologies•added 2025/10/06 12:00 a.m.•9 views

PT-2025-40840

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.5 Description Flowise has a cross-site scripting XSS issue. This occurs through a FORM element and an INPUT element when an administrator views the chat log. Recommendations Update Flowise to version 3.0.5 or late...

8.2CVSS5.8AI score0.00382EPSS

SaveExploits1References8

CNNVD•added 2025/10/06 12:00 a.m.•10 views

SillyTavern 安全漏洞

SillyTavern is an open source front-end interface for a large language model from SillyTavern. A security vulnerability exists in SillyTavern versions prior to 1.13.4, which stems from vulnerability to DNS rebinding attacks that could lead to the installation of malicious extensions, reading chat...

9.6CVSS6.3AI score0.00236EPSS

SaveExploits0References5

Positive Technologies•added 2025/10/06 12:00 a.m.•10 views

PT-2025-40841

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.0.5 Description The software contains a cross-site scripting issue that can be triggered when an administrator views the chat log through an IFRAME element. This could potentially lead to session hijacking and data...

8.2CVSS5.9AI score0.13138EPSS

SaveExploits1References10

OSV•added 2025/10/05 11:40 p.m.•32 views

BIT-DISCOURSE-2025-58054 Discourse is vulnerable to XSS when quoting chat messages

Discourse is an open-source community discussion platform. Versions 3.5.0 and below are vulnerable to XSS attacks through parsing and rendering of chat channel titles and chat thread titles via the quote message functionality when using the rich text editor. This issue is fixed in version 3.5.1...

5.4CVSS6.4AI score0.00189EPSS

SaveExploits0References3

Snyk•added 2025/10/03 9:48 p.m.•14 views

Cross-site Scripting (XSS)

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Cross-site Scripting XSS via the chat logs, due to improper input sanitization. An attacker can access sensitive information or impersonate an administrator by injecting malicious HTML or scripts into chat...

8.2CVSS5.3AI score0.13138EPSS

SaveExploits1References2