exploitDog

CVE-2025-50538

Опубликовано: 06 окт. 2025

Источник: nvd

CVSS3: 8.2

CVSS3: 6.1

EPSS Низкий

Описание

Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.

Ссылки

https://github.com/FlowiseAI/Flowise/pull/4905
Patch
https://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5
Release Notes
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc
Exploit
Third Party Advisory
https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc
Exploit
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:flowiseai:flowise:*:*:*:*:*:*:*:*

Версия до 3.0.5 (исключая)

EPSS

Процентиль: 29%

0.00102

Низкий

8.2 High

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79

Связанные уязвимости

GHSA-964p-j4gg-mhwc

CVSS3: 9.3

github

4 месяца назад

Flowise is vulnerable to stored XSS via "View Messages" allows credential theft in FlowiseAI admin panel

EPSS

Процентиль: 29%

0.00102

Низкий

8.2 High

CVSS3

6.1 Medium

CVSS3

Дефекты

CWE-79