Sim Studio security vulnerabilities

Sim Studio is an open-source AI agent workflow builder developed by Sim Studio. Versions of Sim Studio prior to 0.5.74 contained security vulnerabilities. These vulnerabilities stemmed from authorization checks bypassed in the/api/auth/oauth/token endpoint, which could allow unverified attackers ...

CVE-2025-15522: Improper Neutralization of Input During Web Page Generation

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the automatordiscordusermapping shortcode in all versions up to, and including, 6.10.0.2 due to insufficient input sanitization and output...

@n8n/ai-workflow-builder (0.30.0), @n8n/task-runner (1.56.0) +2 more potentially affected by CVE-2025-65964 via @n8n/config (1.62.0)

@n8n/config NPM version 1.62.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/config and may be impacted: - @n8n/ai-workflow-builder 0.30.0 - @n8n/task-runner 1.56.0 - n8n-core =1.119.0, =1.119.1 - n8n-node-dev 1.118.0 Source cves: CVE-2025-65964...

EUVD-2025-33719

Liferay Portal is vulnerable to XSS through its workflow process builder...

GHSA-XCVW-HH99-QM73 Liferay Portal is vulnerable to XSS through its workflow process builder

Cross-site scripting XSS vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HT...

CVE-2025-62239

Cross-site scripting XSS vulnerability in workflow process builder in Liferay Portal 7.4.3.21 through 7.4.3.111, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.8, and 7.4 update 21 through update 92 allows remote authenticated attackers to inject arbitrary web script or HT...

PT-2025-41561

Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.21 through 7.4.3.111 Liferay DXP versions 2023.Q4.0 through 2023.Q4.5 Liferay DXP versions 2023.Q3.1 through 2023.Q3.8 Liferay versions 7.4 update 21 through update 92 Description A cross-site scripting XSS issue...

CVE-2024-13838: Server-Side Request Forgery (SSRF)

The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.2 via the 'callwebhook' method of the AutomatorSendWebhook class This makes it possible for...