12224 matches found
Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
GHSA-WQ95-WR7M-26H4 Duplicate Advisory: Flowise Stored XSS vulnerability through logs in chatbot
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7r4h-vmj9-wg42. This link is maintained to preserve external references. Original Description Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
CVE-2025-29192
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
CmsEasy 代码注入漏洞
CmsEasy is a content management system CMS for creating responsive websites from China's CmsEasy company. A code injection vulnerability exists in CmsEasy 7.7.7 and earlier versions, which stems from improper manipulation of the parameter PHPSELF in the file lib/inc/view.php in the component URL...
OpenID Connect 授权问题漏洞
OpenID Connect OIDC is a library open-sourced by XWiki Contrib. Makes XWiki a reusable identity provider for any application. An authorization issue vulnerability exists in OpenID Connect OIDC version 2.17.1 through versions prior to 2.18.2, which stems from a user with view privileges being able...
PT-2025-40889
Name of the Vulnerable Software and Affected Versions CmsEasy versions up to 7.7.7 Description A flaw exists in CmsEasy that may allow for cross site scripting. This issue affects an unknown function within the lib/inc/view.php component of the URL Handler. Manipulation of the PHP SELF argument c...
EUVD-2025-32480
Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log...
PT-2025-40900
Name of the Vulnerable Software and Affected Versions XWiki versions 2.17.1 through 2.18.1 Description XWiki OpenID Connect OIDC contains tools for manipulating the OpenID Connect protocol. Individuals with VIEW access to a user profile can generate a token for that user in versions prior to...
BIT-PYTORCH-2025-55558
A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv and is compiled by Inductor, leading to a Denial of Service DoS...
SUSE CVE-2025-49641
A regular Zabbix user with no permission to the Monitoring - Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems...
Cross-site Scripting (XSS)
Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Cross-site Scripting XSS via the workflow UI View Messages feature in the admin panel. An attacker can execute arbitrary JavaScript in the context of an administrator's browser by injecting a specially...
Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
Summary A stored Cross-Site Scripting XSS vulnerability in FlowiseAI allows a user to inject arbitrary JavaScript code via message input. When an administrator views messages using the "View Messages" button in the workflow UI, the malicious script executes in the context of the admin’s browser,...
GHSA-964P-J4GG-MHWC Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel
Summary A stored Cross-Site Scripting XSS vulnerability in FlowiseAI allows a user to inject arbitrary JavaScript code via message input. When an administrator views messages using the "View Messages" button in the workflow UI, the malicious script executes in the context of the admin’s browser,...
CVE-2025-10696 OpenSupports 4.11.0 — Insecure Direct Object Reference in supervised list
OpenSupports exposes an endpoint that allows the list of 'supervised users' for any account to be edited, but it does not validate whether the actor is the owner of that list. A Level 1 staff member can modify the supervision relationship of a third party the target user, who can then view the...
EUVD-2022-46649
Malicious code in bioql PyPI...
EUVD-2025-21512
Malicious code in bioql PyPI...
EUVD-2022-46332
Malicious code in bioql PyPI...
EUVD-2022-32759
Malicious code in bioql PyPI...