109 matches found
CVE-2025-58434-Flowiseai-Auth-Bypass-PoC
CVE-2025-58434 Bypass de Autenticación de Flowiseai PoC...
FlowiseAI Flowise <= 2.2.6 - Arbitrary File Upload
FlowiseAI Flowise version 2.2.6 and below contains an arbitrary file upload vulnerability in the /api/v1/attachments endpoint. This vulnerability allows an unauthenticated attacker to upload files outside the intended directory through path traversal, potentially leading to API key exposure and...
CVE-2025-59528-POC
CVE-2025-59528 - Ejecución Remota de Código en FlowiseAI CustomMCP CVSS 10.0 Crítico | RCE Ciego | FlowiseAI Flowise = 2.2.7-patch.1 y 3.0.6 Resumen Una vulnerabilidad crítica de ejecución remota de código en el nodo CustomMCP de FlowiseAI Flowise. La función convertToValidJSONString pasa la...
CVE-2026-100609
creationtimestamp| type| source ---|---|--- 2026-09-28 02:38:02+00:00| seen| https://www.acn.gov.it/portale/w/flowiseai-poc-pubbliche-per-lo-sfruttamento-di-6-vulnerabilita...
CVE-2026-100608
creationtimestamp| type| source ---|---|--- 2026-09-28 02:38:02+00:00| seen| https://www.acn.gov.it/portale/w/flowiseai-poc-pubbliche-per-lo-sfruttamento-di-6-vulnerabilita...
FlowiseAI-Critical-KillChain
FlowiseAI — Cadena de Ataque Crítica Toma de control de cuenta no autenticada encadenada con ejecución remota de código contra FlowiseAI Compromiso completo del contenedor en menos de 5 segundos , sin necesidad de credenciales. Kill Chain Izquierda: página de inicio de sesión de FlowiseAI —...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580
FlowiseAI Flowise (up to version 3.0.2) contains a server-side request forgery (SSRF) vulnerability in the Evaluations Endpoint . The flaw resides in the axios.post function within packages/server/src/controllers/evaluations/index.ts, where manipulation of the Host or X-Forwarded-Proto header all...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
CVE-2026-90580 FlowiseAI Flowise Evaluations Endpoint index.ts axios.post server-side request forgery
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
PT-2026-90951
Name of the Vulnerable Software and Affected Versions FlowiseAI Flowise versions prior to 3.1.3 Description A server-side request forgery SSRF exists in the Evaluations Endpoint component within the axios.post function of the packages/server/src/controllers/evaluations/index.ts file. This issue...
CVE-2026-90580: Server-Side Request Forgery (SSRF)
A vulnerability was found in FlowiseAI Flowise up to 3.0.2. This vulnerability affects the function axios.post of the file packages/server/src/controllers/evaluations/index.ts of the component Evaluations Endpoint. The manipulation of the argument Host/X-Forwarded-Proto results in server-side...
Exploit for Code Injection in Flowiseai Flowise
PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-E...
CVE-2026-73483: Improper Neutralization of Special Elements used in an OS Command
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
Exploit for Code Injection in Flowiseai Flowise
CVE-2025-59528 Educational PoC Educational use only. Th...
CVE-2026-70473
creationtimestamp| type| source ---|---|--- 2026-08-04 18:35:03+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-fr6g-7cq8-fg82 2026-08-06 20:45:07+00:00| seen| https://www.acn.gov.it/portale/w/aggiornamenti-di-sicurezza-per-flowise 2026-08-10...
CVE-2026-69251
creationtimestamp| type| source ---|---|--- 2026-08-04 16:35:26+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-g32j-mmxr-gfq5...
CVE-2026-69253
creationtimestamp| type| source ---|---|--- 2026-08-04 16:35:21+00:00| published-proof-of-concept| https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-wg86-r78f-74mp 2026-08-04 18:08:05+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3msbm6og5rg23...