37750 matches found
GHSA-C995-4FW3-J39M Duplicate Advisory: Langflow Vulnerable to Code Injection via the `/api/v1/validate/code` endpoint
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-rvqx-wpfh-mfx7. This link is maintained to preserve external references. Original Description Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote an...
CVE-2025-3248
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...
PYSEC-2025-36
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...
PYSEC-2025-36
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrarycode...
CVE-2025-3248 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...
CVE-2025-3248 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...
CVE-2025-3248 Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code...
CVE-2025-3248
CVE-2025-3248 : Langflow versions prior to 1.3.0 are vulnerable to unauthenticated remote code execution via the /api/v1/validate/code endpoint. The root cause is execution of arbitrary Python code through unsanitized input passed to exec(), allowing an attacker to run arbitrary commands without ...
oa_system 代码注入漏洞
oasystem is a hailey individual developer's application for the day-to-day operation and management of an organization, used by employees and managers. A code injection vulnerability exists in oasystem version 2025.01.01 and earlier, which stems from the fact that incorrect manipulation of the...
pb-cms 代码注入漏洞
pb-cms waterfall content management system is a content management system by LinZhaoguan personal developer. A code injection vulnerability exists in version 2.0 of pb-cms, which stems from a misuse of the parameter Classification name that can lead to cross-site scripting...
CVE-2025-3248
Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker Valu...
renren-security 代码注入漏洞
renren-security is a lightweight, front-end and back-end separated Java rapid development platform open source by renrenio. A code injection vulnerability exists in renren-security version 5.4.0 and earlier, which stems from cross-site scripting in JSON Handler...
pb-cms 代码注入漏洞
pb-cms waterfall content management system is a content management system developed by LinZhaoguan. A code injection vulnerability exists in pb-cms version 2.0, which is caused by cross-site scripting in Friendship Link Handler...
CVE-2025-32200
Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in Nikita Advanced WordPress Backgrounds allows Code Injection. This issue affects Advanced WordPress Backgrounds: from n/a through 1.12.4...
CVE-2025-3164
A vulnerability was found in Tencent Music Entertainment SuperSonic up to 0.9.8. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/semantic/database/testConnect of the component H2 Database Connection Handler. The manipulation leads to code...
CVE-2025-3163
A vulnerability was found in InternLM LMDeploy up to 0.7.1. It has been declared as critical. Affected by this vulnerability is the function Open of the file lmdeploy/docs/en/conf.py. The manipulation leads to code injection. It is possible to launch the attack on the local host. The exploit has...
SourceCodester Online Eyewear Shop 代码注入漏洞
SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A code injection vulnerability exists in...