1788 matches found
EUVD-2025-197620
Flowise Fails to Invalidate Existing Sessions After Password Changes...
Insufficient Session Expiration
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate active session tokens after a password change. An attacker can maintain unauthorized access by continuing to use a previously established...
Insufficient Session Expiration
Overview flowise-ui is a Affected versions of this package are vulnerable to Insufficient Session Expiration due to the failure to invalidate active session tokens after a password change. An attacker can maintain unauthorized access by continuing to use a previously established session even afte...
PT-2025-55499
Summary Unverified Email Change - Email as part of Credential / Unverified Account Recovery Channel Change The application allows changing the account email address used as a login identifier and/or password recovery address without verifying the requester’s authority to make that change no...
PT-2025-55496
Summary Bypass of Password Confirmation - Unverified Password Change authenticated change without current password An authenticated user is allowed to change their account password without supplying the current password or any additional verification. The application does not verify the actor’s...
📄 Flowise 3.0.4 Remote Command Execution
Flowise versions prior to 3.0.5 suffer from a remote command execution vulnerability. Exploit Title: Flowise 3.0.4 - Remote Code Execution RCE Date: 10/11/2025 Exploit Author: nltt0 https://github.com/nltt-br Vendor Homepage: https://flowiseai.com/ Software Link:...
Exploit for Code Injection in Flowiseai Flowise
CVE-2025-59528.yaml Flowise is a drag & drop user interface to...
Improper Authentication
flowise is vulnerable to Improper Authentication. The vulnerability is due to minimal authentication and lack of role-based access controls RBAC, followed by the default installation operating without authentication unless explicitly configured, which allows an attacker to execute unauthorized OS...
Flowise 3.0.4 - Remote Code Execution (RCE)
Exploit Title: Flowise 3.0.4 - Remote Code Execution RCE Date: 10/11/2025 Exploit Author: nltt0 https://github.com/nltt-br Vendor Homepage: https://flowiseai.com/ Software Link: https://github.com/FlowiseAI/Flowise Version: 3.0.5 CVE: CVE-2025-59528 from requests import post, session from argpars...
PT-2025-44570
Name of the Vulnerable Software and Affected Versions react-router versions 7.0.0 through 7.8.2 @remix-run/react versions 1.15.0 through 2.17.0 Description A cross-site scripting XSS issue exists in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags. This could allow...
PT-2025-44571
Name of the Vulnerable Software and Affected Versions React Router versions 7.0.0 through 7.9.3 @remix-run/deno versions prior to 2.17.2 @remix-run/node versions prior to 2.17.2 Description The issue concerns a path traversal flaw in React Router and Remix when using the createFileSessionStorage...
The vulnerability of Flowise’s software platform for creating user interfaces based on language models (LLMs) lies in the lack of authentication for a critical function, allowing attackers to gain unauthorized access to protected information.
The vulnerability of the Flowise application development platform lies in the lack of authentication for critical functions. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...
Remote Code Execution (RCE)
Flowise is vulnerable to remote code execution RCE. The vulnerability is due to unsanitized evaluation of user input in the “Supabase RPC Filter” field, which allows an attacker to execute arbitrary code on the affected system...
Server-Side Request Forgery (SSRF)
Flowise is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of user-supplied URLs in the /api/v1/fetch-links endpoint, which allows an attacker to exploit the server as a proxy to access internal network resources and explore their link structures...
Flowise File Upload Vulnerability (CNVD-2025-24788)
Flowise is a FlowiseAI open source tool for easily building LLM applications. A file upload vulnerability exists in Flowise version 3.0.7, which stems from a file upload process that does not validate the file extension, MIME type, or file content, and can be exploited by an attacker to cause...
CVE-2025-57164
Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field...
GHSA-3G4J-R53P-22WX Duplicate Advisory: FlowiseAI Pre-Auth Arbitrary Code Execution
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7944-7c6r-55vv. This link is maintained to preserve external references. Original Description Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supaba...
Duplicate Advisory: FlowiseAI Pre-Auth Arbitrary Code Execution
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7944-7c6r-55vv. This link is maintained to preserve external references. Original Description Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supaba...
