Flowise Allows Mass Assignment in `/api/v1/leads` Endpoint

Summary A Mass Assignment vulnerability in the /api/v1/leads endpoint allows any unauthenticated user to control internal entity fields id, createdDate, chatId by including them in the request body. The endpoint uses Object.assign to copy all properties from the request body to the Lead entity...

Spacecom Log2Space Subscriber Management Software 安全漏洞

Spacecom Log2Space Subscriber Management Software is a subscriber user management software from Spacecom India. A security vulnerability exists in Spacecom Log2Space Subscriber Management Software version 1.1, which stems from a failure to validate and clean the leadid parameter in the...

EUVD-2025-35180

Log2Space Subscriber Management Software 1.1 is vulnerable to unauthenticated SQL injection via the leadid parameter in the /l2s/api/selfcareLeadHistory endpoint. A remote attacker can exploit this by sending a specially crafted POST request, resulting in the execution of arbitrary SQL queries. T...