{"id":"EUVD-2025-10669","enisaUuid":"767e2fd2-73d8-3ed1-9fa3-ae996c5a6e3f","description":"Flowise \u003c\u003d 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.","datePublished":"Apr 9, 2025, 12:00:00 AM","dateUpdated":"Apr 9, 2025, 2:42:51 PM","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp\u003dsharing\n","aliases":"CVE-2025-29189\nGHSA-gjx9-wg9x-7gvp\n","assigner":"mitre","epss":0.32,"enisaIdProduct":[{"id":"c5309709-ec18-318b-9253-f8c5881324f9","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"enisaIdVendor":[{"id":"1787c400-517b-3602-b011-ab45a4bd5814","vendor":{"name":"n/a"}}],"enisaIdVulnerability":[{"id":"08c295a2-8137-3a7d-90d9-fea3fedeaac7","vulnerability":{"id":"GHSA-gjx9-wg9x-7gvp","description":"Flowise Vulnerable to SQL Injection via `tableName` Parameter","datePublished":"Apr 9, 2025, 12:30:24 PM","dateUpdated":"Apr 10, 2025, 2:18:52 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2025-29189\nhttps://github.com/FlowiseAI/Flowise/pull/3818\nhttps://github.com/FlowiseAI/Flowise/commit/9a417bdc95f58d6dd92cbf60dad42414aba34754\nhttps://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp\u003dsharing\nhttps://github.com/FlowiseAI/Flowise\n","enisa_id":"EUVD-2025-10669\n","aliases":"CVE-2025-29189\nGHSA-gjx9-wg9x-7gvp\n","epss":0.0,"dataProcessed":"May 3, 2026, 2:11:34 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"baaa6dcc-667b-360c-9872-fa4e6621560c","vulnerability":{"id":"CVE-2025-29189","description":"Flowise \u003c\u003d 2.2.3 is vulnerable to SQL Injection. via tableName parameter at Postgres_VectorStores.","datePublished":"Apr 9, 2025, 12:00:00 AM","dateUpdated":"Apr 9, 2025, 2:42:51 PM","status":"PUBLISHED","baseScore":7.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","references":"https://drive.google.com/file/d/1WHPslTmQmAM9xPJifULS2qAo7hcidB4L/view?usp\u003dsharing\n","enisa_id":"EUVD-2025-10669\n","assigner":"mitre","epss":0.32,"dataProcessed":"Nov 8, 2026, 7:18:04 AM","vulnerabilityProduct":[{"id":"197f8955-0199-39d2-ae24-c6aaaa95d79d","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"},{"id":"52986df7-bafe-4cf4-8290-7e0602682db9","product":{"name":"n/a","vendor":{"name":"n/a"}},"product_version":"n/a"}],"vulnerabilityVendor":[{"id":"712b7fcd-0a20-3ccd-bc8c-5af08a61fa3f","vendor":{"name":"n/a"}}]}}],"enisaIdAdvisory":[{"id":"021fcf66-08d0-3404-a468-018aba113827","advisory":{"id":"WID-SEC-W-2025-0785","description":"Flowise: Schwachstelle ermöglicht Manipulation von Dateien","summary":"Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Flowise ausnutzen, um Dateien zu manipulieren.","datePublished":"Apr 10, 2025, 10:00:00 PM","dateUpdated":"Apr 10, 2025, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-0785.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2025-0785\n","aliases":"CVE-2025-29189\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"42b5b02a-7f6b-31c1-86c1-e6b29bcc5c8f","product":{"name":"2.2.4","vendor":{"name":"open source"}}},{"id":"63868904-5191-312b-8cc0-38b761b68757","product":{"name":"Open Source Flowise 2.2.4","vendor":{"name":"open source"}}},{"id":"9d2eb92d-7845-3632-9bcf-36044d78e309","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}}},{"id":"eef853c5-777a-3acc-80af-7807b6f1726e","product":{"name":"Open Source Flowise \u003c2.2.4","vendor":{"name":"open source"}}}]}}]}