langgenius/dify

7 results · Clear filters · Feed

• Medium 4.3
  CVE-2025-11750 Scanner template

  User Enumeration via Distinct Error Messages in langgenius/dify-web

  In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-exist…

  langgenius langgenius/dify
  Oct 22, 2025
• Medium 6.5
  CVE-2025-0184 Public exploit

  Server-Side Request Forgery (SSRF) in langgenius/dify

  A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section when uploading DOCX files. If an external relationship exists in the DOCX file, the reltype value i…

  langgenius langgenius/dify
  Mar 20, 2025
• Medium 6.8
  CVE-2024-11850

  Stored XSS in langgenius/dify

  A stored cross-site scripting (XSS) vulnerability exists in the latest version of langgenius/dify. The vulnerability is due to improper validation and sanitization of user input in SVG markdown support within the chatbot feature. An attacker can exploit this …

  langgenius langgenius/dify
  Mar 20, 2025
• Medium 6.5
  CVE-2024-12775

  SSRF in langgenius/dify

  langgenius/dify version 0.10.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the test functionality for the Create Custom Tool option via the REST API `POST /console/api/workspaces/current/tool-provider/api/test/pre`. Attackers can set the `u…

  langgenius langgenius/dify
  Mar 20, 2025
• Medium 6.5
  CVE-2024-11822

  Server-Side Request Forgery (SSRF) in langgenius/dify

  langgenius/dify version 0.9.1 contains a Server-Side Request Forgery (SSRF) vulnerability. The vulnerability exists due to improper handling of the api_endpoint parameter, allowing an attacker to make direct requests to internal network services. This can lea…

  langgenius langgenius/dify
  Mar 20, 2025
• Medium 5.8
  CVE-2024-11824

  Stored XSS in langgenius/dify

  A stored cross-site scripting (XSS) vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like <input> and <form> are not disallowed, allowing an attacker to inje…

  langgenius langgenius/dify
  Mar 20, 2025
• Medium 4.3
  CVE-2024-11821

  Privilege Escalation in langgenius/dify

  A privilege escalation vulnerability exists in langgenius/dify version 0.9.1. This vulnerability allows a normal user to modify Orchestrate instructions for a chatbot created by an admin user. The issue arises because the application does not properly enforce…

  langgenius langgenius/dify
  Mar 20, 2025