The Brandfolder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 5.0.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
[POC] CVE-2025-58434 — CVE-2025-58434-AND-59528-POC
Combined PoC for CVE-2025-28434 and CVE-2025-59528
[POC] CVE-2025-58434 — FlowiseAI-CVE-Chain-PoC
FlowiseAI CVE-2025-58434 & CVE-2025-59528 exploit PoC, demonstrating unauthenticated ATO via reset token leakage, followed by authenticated RCE. Includes a reproductible Docker lab environment.
[POC] CVE-2025-58434 — HackTheBox-Silentium
Full walkthrough of HackTheBox "Silentium" (Medium/Linux). Chains three CVEs: CVE-2025-58434 leaks a Flowise password reset token unauthenticated, enabling account takeover; CVE-2025-59528 achieves RCE via unsanitized CustomMCP node; env vars expose SSH credentials for lateral movement. CVE-2025-8110 exploits Gogs symlink write as root to escalate.
[POC] CVE-2025-58434 — CVE-2025-58434-PoC
This repository contains a Proof of Concept (PoC) Python script for CVE-2025-58434, which enables attackers to change passwords of other users without authentication process in flowise version 3.0.5 and lower due to token leakage.
[POC] CVE-2025-58434 — CVE-PoC-CVE-2025-58434
CVE PoC — CVE-2025-58434
[POC] CVE-2025-58434 — HTB-Silentium-Writeup
Hack The Box - Silentium machine writeup | CVE-2025-58434, CVE-2025-59528, CVE-2025-8110
[POC] CVE-2025-58434 — CVE-2025-58434-PoC
CVE-2025-58434 Proof of Concept
[POC] CVE-2025-58434 — HTB-Silentium-Writeup
Hack The Box - Silentium machine writeup | CVE-2025-58434, CVE-2025-59528, CVE-2025-8110
[POC] CVE-2025-58434 — CVE-2025-58434-Unauthenticated-Password-Reset-Flowwise
The forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO).
[POC] CVE-2025-58434 — Flowise-CVE-2025-58434-PasswordReset
Unauthenticated password reset exploit for Flowise AI ≤ 3.0.5. Abuses the /api/v1/account/forgot-password endpoint to change any user's password without prior authentication. Includes a proof-of-concept script and mitigation guidelines.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free