{"id":"EUVD-2025-210326","enisaUuid":"863c8d48-7bc2-3399-a4ef-dd5a9d9093b4","description":"Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.","datePublished":"Jun 24, 2026, 11:53:05 AM","dateUpdated":"Jun 24, 2026, 6:31:32 PM","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9c4c-g95m-c8cp\nhttps://www.vulncheck.com/advisories/flowise-sql-injection-in-importchatflows-api-via-chatflow-id-parameter\n","aliases":"CVE-2025-71332\n","assigner":"VulnCheck","epss":0.52,"enisaIdProduct":[{"id":"10141949-13fb-3f36-bec1-31292db23230","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 ≤2.2.7"}],"enisaIdVendor":[{"id":"45b647fd-cc8c-3ce3-9057-aedbd0da2bb9","vendor":{"name":"Flowise"}}],"enisaIdVulnerability":[{"id":"a98fcbee-5944-3223-ac4a-8400679656ee","vulnerability":{"id":"CVE-2025-71332","description":"Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.","datePublished":"Jun 24, 2026, 11:53:05 AM","dateUpdated":"Jun 24, 2026, 6:31:32 PM","status":"PUBLISHED","baseScore":8.5,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-9c4c-g95m-c8cp\nhttps://www.vulncheck.com/advisories/flowise-sql-injection-in-importchatflows-api-via-chatflow-id-parameter\n","enisa_id":"EUVD-2025-210326\n","assigner":"VulnCheck","epss":0.52,"dataProcessed":"Nov 6, 2026, 7:20:40 AM","vulnerabilityProduct":[{"id":"73c94866-6e25-3f76-8042-09fd7fe6605e","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 ≤2.2.7"}],"vulnerabilityVendor":[{"id":"69b4c4de-0a50-399f-83fb-50725320ab99","vendor":{"name":"Flowise"}}]}}],"enisaIdAdvisory":[]}