CVE Listesine Dön
CVE-2025-59528

Code injection in Flowiseai

CVSS Skor

10.0

EPSS İhtimal

%86.2

Risk Skoru

8.6

Yayın

1 yıl önce

Overview (Genel Bakış)Public Exploits (15)Newsroom (Haberler)Vulnerability Timeline

Public Exploits · GitHub ve Metasploit Intelligence

Bu sekme NVD’nin exploit olarak etiketlediği kaynakları, CVE kimliğiyle eşleşen GitHub depolarını ve Rapid7 Metasploit Framework modüllerini tarar. Yalnızca bulunan gerçek kaynak bağlantıları gösterilir.

G
mananispiwpiw/CVE-2025-59528-PoC
GitHub

CVE-2025-59528 Proof of Concept (★1)

Public PoCKaynak güncellemesi: 10.05.2026 11:43:26
G
hackpatato/PoC-and-yara-rules-of-CVE-2025-59528-Flowise-has-Remote-Code-Execution-vulnerability
GitHub

poc and yara rules (★1)

Public PoCKaynak güncellemesi: 28.08.2026 21:57:57
G
B1ack4sh/Blackash-CVE-2025-59528
GitHub

CVE-2025-59528 (★0)

Public PoCKaynak güncellemesi: 27.11.2025 23:48:33
G
UsifAraby/CVE-2025-59528-POC
GitHub

CVE-2025-59528 - FlowiseAI CustomMCP Remote Code Execution (★0)

Public PoCKaynak güncellemesi: 13.04.2026 23:40:55
G
vanhari/CVE-2025-59528
GitHub

CVE-2025-59528 Proof of Concept (★0)

Public PoCKaynak güncellemesi: 14.04.2026 08:02:04
G
maradonam18/-CVE-2025-59528-PoC
GitHub

A simple python script to exploit CVE-2025-59528, this an Authenticated RCE vulnerability in Flowise application, a popular AI tool. That is also used in HTB seasonal challenge. The issue is present in version <= 3.0.5, for more details: https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p (★0)

Public PoCKaynak güncellemesi: 15.04.2026 15:47:13
G
r3nsi15/Flowise-RCE-CVE-2025-59528
GitHub

Authenticated Remote Code Execution (RCE) exploit for Flowise AI versions ≤ 3.0.4. Leverages a vulnerability in the /api/v1/node-load-method/customMCP endpoint to execute arbitrary system commands via Node.js child_process.execSync(). Includes full PoC script and remediation steps. (★0)

Public PoCKaynak güncellemesi: 15.04.2026 21:50:43
G
im-nymii/CVE-2025-59528
GitHub

Technical PoC for CVE-2025-59528 (Flowise < 3.0.5), demonstrating authenticated RCE through customMCP mcpServerConfig injection, with clear bilingual documentation and reproducible steps for authorized security testing. (★0)

Public PoCKaynak güncellemesi: 17.05.2026 03:11:42
G
corey-farley/CVE-2025-59528-Flowise-RCE
GitHub

Authenticated RCE PoC for Flowise version <= 3.0.5 via CustomMCP Node (CVE-2025-59528) (★0)

Public PoCKaynak güncellemesi: 17.05.2026 22:47:56
G
Moon-Harvest/CVE-2025-59528
GitHub

Go Proof of Concept (PoC) exploit for Flowise CustomMCP Remote Code Execution (RCE) CVE-2025-59528 (★0)

Public PoCKaynak güncellemesi: 09.06.2026 09:42:31
G
Loaxert/CVE-2025-59528-PoC
GitHub

PoC for CVE-2025-59528 used to achieve remote code execution on the Silentium machine at HTB (★0)

Public PoCKaynak güncellemesi: 10.08.2026 03:20:24
G
sonnelon/CVE-2025-59528-PoC
GitHub

The poc of CVE-2025-59528 (★0)

Public PoCKaynak güncellemesi: 10.08.2026 16:22:57
E
Flowise 3.0.4 - Remote Code Execution (RCE)
Exploit-DB

Flowise 3.0.4 - Remote Code Execution (RCE)

Exploit referansıKaynak güncellemesi: 31.10.2025 00:00:00
N
projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-59528.yaml
Nuclei

Nuclei: Flowise - Remote Code Execution

Exploit referansı
G
FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p
GitHub

https://github.com/FlowiseAI/Flowise/security/advisories/GHSA-3gcm-f6qx-ff7p

Exploit referansı

İlgili Benzer Açıklar

Bu açığı API ile alın

Etkilenen ürünler, sürüm aralıkları, istismar durumu ve yama bilgisi tek istekte; ücretsiz anahtarla.

Ücretsiz anahtar alBelgeler
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2025-59528"