Lucene search
+L

337 matches found

CVE
CVE
added 2025/12/18 12:00 a.m.99 views

CVE-2025-63387

CVE-2025-63387 affects Dify v1.9.1. An unauthenticated GET request to the endpoint /console/api/system-features bypasses authorization, exposing sensitive system configuration data. This constitutes a broken access control issue described across multiple sources (NVD, nuclei template, VulnCheck K...

7.5CVSS5.5AI score0.30318EPSS
SaveIn wildExploits0References6Affected Software1
OSV
OSV
added 2025/12/18 12:00 a.m.8 views

CVE-2025-56157

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL on TCP port 5432 exposed by default in version 1.0.1 or later...

9.8CVSS5.9AI score
SaveExploits0References9
OSV
OSV
added 2025/12/18 12:00 a.m.13 views

CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...

7.5CVSS5.6AI score
SaveExploits0References8
CNNVD
CNNVD
added 2025/12/18 12:00 a.m.9 views

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.5.1 of dify that stems from default credentials and could lead to unauthorized access...

9.8CVSS6.5AI score0.00873EPSS
SaveExploits1References6
Vulnrichment
Vulnrichment
added 2025/12/18 12:00 a.m.4 views

CVE-2025-63388

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any...

6AI score0.00227EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB
added 2025/12/18 12:00 a.m.6 views

CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...

7.5CVSS5.6AI score0.30318EPSS
SaveExploits0References8
Vulnrichment
Vulnrichment
added 2025/12/18 12:00 a.m.7 views

CVE-2025-63386

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains t...

5.7AI score0.00241EPSS
SaveExploits0References4
CNNVD
CNNVD
added 2025/12/18 12:00 a.m.44 views

dify 安全漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.9.1 of dify, which stems from improper privileges and could lead to unauthorized access to system configuration data...

7.5CVSS6.4AI score0.30318EPSS
SaveExploits0References7
Cvelist
Cvelist
added 2025/12/18 12:00 a.m.38 views

CVE-2025-63386

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains t...

0.00241EPSS
SaveExploits0References4
Cvelist
Cvelist
added 2025/12/18 12:00 a.m.269 views

CVE-2025-63387

Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials or session tokens. The endpoint fails to implement proper authorization checks, allowing anonymous...

0.30318EPSS
SaveExploits0References6
CVE
CVE
added 2025/12/18 12:00 a.m.18 views

CVE-2025-63388

The CVE-2025-63388 entry concerns Dify v1.9.1, specifically the /console/api/system-features endpoint. A misconfigured CORS policy is described as reflecting arbitrary Origin headers and setting Access-Control-Allow-Credentials: true, potentially enabling cross-origin requests to be authenticated...

9.1CVSS6AI score0.00227EPSS
SaveExploits0References3Affected Software1
Cvelist
Cvelist
added 2025/12/18 12:00 a.m.37 views

CVE-2025-63388

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any...

0.00227EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment
added 2025/12/18 12:00 a.m.5 views

CVE-2025-56157

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL on TCP port 5432 exposed by default in version 1.0.1 or later...

5.9AI score0.00873EPSS
SaveExploits1References7
Positive Technologies
Positive Technologies
added 2025/12/18 12:00 a.m.13 views

PT-2025-52262

Name of the Vulnerable Software and Affected Versions Dify version 1.9.1 Description A Cross-Origin Resource Sharing CORS misconfiguration exists in the /console/api/setup endpoint. The endpoint has an insecure CORS policy that reflects any Origin header and allows Access-Control-Allow-Credential...

9.1CVSS6.5AI score0.00241EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2025/12/18 12:00 a.m.10 views

PT-2025-52280

Name of the Vulnerable Software and Affected Versions Dify versions through 1.5.1 Description The software contains default credentials. Specifically, the PostgreSQL username and password are specified in the docker-compose.yaml file included in the source code. Recommendations Versions prior to...

9.8CVSS6.7AI score0.00873EPSS
SaveExploits1References17
OSV
OSV
added 2025/12/18 12:00 a.m.10 views

CVE-2025-63388

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implements an overly permissive CORS policy that reflects arbitrary Origin headers and sets Access-Control-Allow-Credentials: true, allowing any...

9.1CVSS6AI score
SaveExploits0References5
OSV
OSV
added 2025/12/18 12:00 a.m.11 views

CVE-2025-63386

A Cross-Origin Resource Sharing CORS misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an insecure CORS policy that reflects any Origin header and enables Access-Control-Allow-Credentials: true, permitting arbitrary external domains t...

9.1CVSS5.7AI score
SaveExploits0References6
NVD
NVD
added 2025/10/22 2:15 p.m.9 views

CVE-2025-11750

In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...

5.3CVSS0.00711EPSS
SaveExploits1References1
Vulnrichment
Vulnrichment
added 2025/10/22 1:13 p.m.6 views

CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web

In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...

4.3CVSS6.7AI score0.00711EPSS
SaveExploits1References1
CVE
CVE
added 2025/10/22 1:13 p.m.27 views

CVE-2025-11750

CVE-2025-11750 affects langgenius/dify-web version 1.6.0. Multiple connected sources confirm an authentication flaw where login/registration error messages distinguish between non-existent vs. existing usernames or emails (e.g., “account not found”), enabling user enumeration. This can facilitate...

5.3CVSS5.2AI score0.00711EPSS
SaveExploits1References1Affected Software1
Rows per page
Query Builder