CVE-2025-71331 - Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows

CVE ID :CVE-2025-71331
Published : June 20, 2026, 3:24 p.m. | 2 hours, 11 minutes ago
Description :Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An attacker can inject malicious JavaScript by sending an iframe payload (e.g.,

Top Articles

CVE-2026-44492 - Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

CVE-2025-10023 - A user with elevated privileges can inject XSS in the Services Meta-services configuration page

CVE-2020-37132 - UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service

CVE-2025-14673 - gmg137 snap7-rs client.rs as_ct_write heap-based overflow

CVE-2026-2026 - Improper Access Control Allows Denial of Service

CVE-2017-20266 - Joomla SP Movie Database 1.3 SQL Injection via searchword

CVE-2026-0630 - Command Injection Vulnerability on TP-Link Archer BE230 v1.2

CVE-2026-1737 - Open5GS CreateBearerRequest s5c-handler.c sgwc_s5c_handle_create_bearer_request assertion

CVE-2025-13523 - Cross-Site Scripting (XSS) via Unescaped Display Names in Mattermost Confluence Plugin OAuth2 Flow

CVE-2026-26366 - JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials

CVE-2025-71331 - Flowise - Cross-Site Scripting in Chat Messages and Agent Workflows

CVE-2026-44492 - Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

CVE-2025-10023 - A user with elevated privileges can inject XSS in the Services Meta-services configuration page

CVE-2020-37132 - UltraVNC Launcher 1.2.4.0 - 'Password' Denial of Service

Contact Form