InfiniFlow RAGFlow

Remote Code Execution in infiniflow/ragflow

RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser

RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow

RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability

RAGFlow SQL Injection vulnerability

RAGFlow through 0.18.1 allows account takeover because it is possible to conduct successful brute-force attacks against email verification codes to perform arbitrary account registration, login, and password reset. Codes are six digits and there is no rate limiting.

Remote Code Execution in infiniflow/ragflow

RAGFlow Remote Code Execution Vulnerability

RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component

Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow

Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow

SSRF in infiniflow/ragflow

RAGFlow 0.13.0 suffers from improper access control in document-hooks.ts, allowing unauthorized access to user documents.

Stored Cross-site Scripting (XSS) vulnerability in api.apps.dialog_app.set_dialog in RAGFlow 0.17.2 allows remote attackers to execute arbitrary JavaScript via crafted input to the assistant greeting field, which is stored unsanitised and rendered using a markdown component with rehype-raw.

Stored Cross-site Scripting (XSS) in infiniflow/ragflow

Improper Authentication in infiniflow/ragflow