Flowiseai

Flowise

29 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
6.1

CVE-2025-50538

Exploit
  • EPSS 0.08%
  • Veröffentlicht 06.10.2025 00:00:00
  • Zuletzt bearbeitet 07.10.2025 17:03:12

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

6.1

CVE-2025-29192

Exploit
  • EPSS 0.05%
  • Veröffentlicht 06.10.2025 00:00:00
  • Zuletzt bearbeitet 07.10.2025 17:03:25

Flowise before 3.0.5 allows XSS via a FORM element and an INPUT element when an admin views the chat log.

9.6

CVE-2025-59434

  • EPSS 0.05%
  • Veröffentlicht 22.09.2025 20:15:39
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment varia...

10

CVE-2025-59528

Medienbericht Exploit
  • EPSS 82.39%
  • Veröffentlicht 22.09.2025 20:15:39
  • Zuletzt bearbeitet 23.09.2025 16:45:09

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connecting to an external M...

7.5

CVE-2025-59527

Exploit
  • EPSS 0.13%
  • Veröffentlicht 22.09.2025 20:15:39
  • Zuletzt bearbeitet 23.09.2025 16:47:43

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, a Server-Side Request Forgery (SSRF) vulnerability was discovered in the /api/v1/fetch-links endpoint of the Flowise application. This vulnerab...

9.8

CVE-2025-58434

Medienbericht Exploit
  • EPSS 9.93%
  • Veröffentlicht 12.09.2025 17:37:08
  • Zuletzt bearbeitet 20.09.2025 02:54:59

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authen...

9.8

CVE-2025-8943

Medienbericht Exploit
  • EPSS 83.99%
  • Veröffentlicht 14.08.2025 09:54:22
  • Zuletzt bearbeitet 23.09.2025 15:23:05

The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. However, Flowise's inherent authentication and authorization model is minimal and lacks role-based access controls (RBAC). ...

7.6

CVE-2025-29189

Exploit
  • EPSS 0.56%
  • Veröffentlicht 09.04.2025 00:00:00
  • Zuletzt bearbeitet 22.04.2025 17:11:10

Flowise <= 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.

9.8

CVE-2025-26319

Medienbericht Exploit
  • EPSS 81.48%
  • Veröffentlicht 04.03.2025 22:15:40
  • Zuletzt bearbeitet 24.06.2025 00:50:39

FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments.

6.1

CVE-2024-9148

Exploit
  • EPSS 1.93%
  • Veröffentlicht 25.09.2024 01:15:49
  • Zuletzt bearbeitet 30.09.2024 17:34:12

Flowise < 2.1.1 suffers from a Stored Cross-Site vulnerability due to a lack of input sanitization in Flowise Chat Embed < 2.0.0.