EUVD-2025-24803

Flowise vulnerable to RCE via Dynamic function constructor injection...

GHSA-HMGH-466J-FX4C Flowise vulnerable to RCE via Dynamic function constructor injection

Summary User-controlled input flows to an unsafe implementaion of a dynamic Function constructor , allowing a malicious actor to run JS code in the context of the host not sandboxed leading to RCE. Details When creating a new Custom MCP Chatflow in the platform, the MCP Server Config displays a...

Flowise vulnerable to RCE via Dynamic function constructor injection

Summary User-controlled input flows to an unsafe implementaion of a dynamic Function constructor , allowing a malicious actor to run JS code in the context of the host not sandboxed leading to RCE. Details When creating a new Custom MCP Chatflow in the platform, the MCP Server Config displays a...

WordPress Constructor plugin <= 1.6.5 - Missing Authorization to Authenticated (Subscriber+) Theme Clean vulnerability

Missing Authorization to Authenticated Subscriber+ Theme Clean vulnerability discovered by Sulabh Jain pentestmonkey11 in WordPress Theme Constructor versions = 1.6.5...

EUVD-2022-1752

Malicious code in bioql PyPI...

EUVD-2023-36294

Malicious code in bioql PyPI...

EUVD-2022-3963

Malicious code in bioql PyPI...

EUVD-2022-5735

Malicious code in bioql PyPI...

EUVD-2025-26409

Malicious code in bioql PyPI...

EUVD-2022-44468

Malicious code in bioql PyPI...

EUVD-2022-1956

Malicious code in bioql PyPI...

EUVD-2022-4100

Malicious code in bioql PyPI...

EUVD-2025-26411

Malicious code in bioql PyPI...

EUVD-2023-2165

Malicious code in bioql PyPI...

EUVD-2023-2356

Malicious code in bioql PyPI...

EUVD-2023-36475

Malicious code in bioql PyPI...

EUVD-2022-2227

Malicious code in bioql PyPI...

EUVD-2024-3277

Malicious code in bioql PyPI...

EUVD-2022-0813

Malicious code in bioql PyPI...

CVE-2025-9194

The Constructor theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clean function in all versions up to, and including, 1.6.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger a them...