{"id":"EUVD-2025-32219","enisaUuid":"a95fcfd0-d923-3e98-8e17-bc1e8ed09069","description":"Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.","datePublished":"Oct 6, 2025, 12:00:00 AM","dateUpdated":"Oct 6, 2025, 1:53:37 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc\nhttps://github.com/FlowiseAI/Flowise/pull/4905\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5\n","aliases":"CVE-2025-50538\nGHSA-7rgr-72hp-9wp3\nGHSA-964p-j4gg-mhwc\n","assigner":"mitre","epss":14.71,"enisaIdProduct":[{"id":"262b73b5-52ef-3a79-95cf-c1488862146d","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.5"}],"enisaIdVendor":[{"id":"8c01fb05-3628-3019-9c44-130f31c2b5d9","vendor":{"name":"FlowiseAI"}}],"enisaIdVulnerability":[{"id":"0b51b7d9-46f3-3203-ae14-274f8e5a6771","vulnerability":{"id":"GHSA-7rgr-72hp-9wp3","description":"Duplicate Advisory: Flowise is vulnerable to stored XSS via \"View Messages\" allows credential theft in FlowiseAI admin panel","datePublished":"Oct 6, 2025, 3:31:38 AM","dateUpdated":"Oct 8, 2025, 7:34:58 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-50538\nhttps://github.com/FlowiseAI/Flowise/pull/4905\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5\n","enisa_id":"EUVD-2025-32219\n","aliases":"GHSA-7rgr-72hp-9wp3\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:53:16 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"340247da-c5a0-3819-a534-22194aceb7bb","vulnerability":{"id":"CVE-2025-50538","description":"Flowise before 3.0.5 allows XSS via an IFRAME element when an admin views the chat log.","datePublished":"Oct 6, 2025, 12:00:00 AM","dateUpdated":"Oct 6, 2025, 1:53:37 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc\nhttps://github.com/FlowiseAI/Flowise/pull/4905\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5\n","enisa_id":"EUVD-2025-32219\n","assigner":"mitre","epss":14.71,"dataProcessed":"Nov 8, 2026, 7:20:29 AM","vulnerabilityProduct":[{"id":"63d7675c-867e-381f-a187-f86adb18a983","product":{"name":"Flowise","vendor":{"name":"FlowiseAI"}},"product_version":"0 \u003c3.0.5"}],"vulnerabilityVendor":[{"id":"f8249280-2eff-3b13-8b4b-7bd1b2be080b","vendor":{"name":"FlowiseAI"}}]}},{"id":"5da40bfe-e597-3638-a88d-1a5904b4a2be","vulnerability":{"id":"GHSA-964p-j4gg-mhwc","description":"Flowise is vulnerable to stored XSS via \"View Messages\" allows credential theft in FlowiseAI admin panel","datePublished":"Oct 3, 2025, 9:47:37 PM","dateUpdated":"Oct 13, 2025, 5:38:22 PM","baseScore":0.0,"references":"https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-964p-j4gg-mhwc\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-50538\nhttps://github.com/FlowiseAI/Flowise/pull/4905\nhttps://github.com/FlowiseAI/Flowise/commit/9a06a85a8ddcbaeca1342827a5fea9087a587d97\nhttps://github.com/FlowiseAI/Flowise\nhttps://github.com/FlowiseAI/Flowise/releases/tag/flowise%403.0.5\n","enisa_id":"EUVD-2025-32219\n","aliases":"GHSA-964p-j4gg-mhwc\nCVE-2025-50538\n","epss":0.0,"dataProcessed":"Nov 8, 2026, 1:53:16 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}