LangGenius Dify any version

Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Supplier reports that the Docker configuration does not make PostgreSQL (on TCP port 5432) exposed by default in version 1.0.1 or later.

Unsanitized Input in langgenius/dify

Code Injection in langgenius/dify

XSS Vulnerability in langgenius/dify

Stored XSS in langgenius/dify

Dify Allows Unauthorized Access and Modification of APP Orchestration

Dify Vulnerable to Stored XSS via SVG-file upload

Server-Side Request Forgery (SSRF) in langgenius/dify

Dify < 1.14.0 Authorization Bypass via File UUID

Dify Allows Unauthorized APP Enable/Disable via API

Dify Allows Insecure User Role Access Control for APP Editing

Dify Allows Insecure User Role Access Control for APP DSL Exporting

Dify MCP OAuth Flow Vulnerable to XSS

DIFY vulnerable to Clickjacking Attack