CVE-2025-57164

MediumCVSS 6.5/10Last modified Nov 5, 2026

Description

Flowise through v3.0.4 is vulnerable to remote code execution via unsanitized evaluation of user input in the "Supabase RPC Filter" field.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-77

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Oct 17, 2025
Last modified
Nov 5, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-57177.2An authenticated remote code execution (RCE) vulnerability exists in multiple WSO2 products due to improper input validation in the event prCVE-2025-571749.8An issue was discovered in Siklu Communications Etherhaul 8010TX and 1200FX devices, Firmware 7.4.0 through 10.7.3 and possibly other previoCVE-2025-571756.8Siklu EtherHaul 8010 siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b devices have a static root password.CVE-2025-571766.5On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP poCVE-2025-57186.8The ACAP Application framework could allow privilege escalation through a symlink attack. This vulnerability can only be exploited if the AxCVE-2025-57195.1The wallet has an authentication bypass vulnerability that allows access to specific pages.CVE-2025-571976.0In the Payeer Android application 2.5.0, an improper access control vulnerability exists in the authentication flow for the PIN change featuCVE-2025-571988.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iCVE-2025-571998.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iCVE-2025-57206.4The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘author’ parameter in all verCVE-2025-572006.5AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability iCVE-2025-572018.8AVTECH SECURITY Corporation DGM1104 FullImg-1015-1004-1006-1003 was discovered to contain an authenticated command injection vulnerability i
CVE-2025-57164: Medium severity, CVSS 6.5 | Vulnix