Name: Vietnam CyStack Joint Stock Company
Address: Tan Hong Ha Complex, 317 Truong Chinh Street, Hanoi, Vietnam, 100000, VN
Telephone: (+84) 247 109 9656
Price range: Negotiable

Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

VulnScan

infiniflow Security Vulnerabilities | CyStack CVE Database

Vulnerability	Exploitation status	Fix	Affected product	Published	Severity

`CVE-2026-93013`RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal	Exploitation statusNot confirmed	FixYes	Affected productragflow	Published09/17/2026	SeverityMedium
`CVE-2026-75898`RAGFlow < 0.26.3 - Server-Side Request Forgery via Agent Invoke Component	Exploitation statusPublic exploit	FixYes	Affected productragflow	Published08/18/2026	SeverityHigh
`CVE-2026-58579`RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name	Exploitation statusPublic exploit	FixYes	Affected productragflow	Published07/02/2026	SeverityMedium
`CVE-2026-45312`RAGFlow: Server-Side Template Injection in Prompt Generator leads to Remote Code Execution	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published05/29/2026	SeverityCritical
`CVE-2026-28797`RAGFlow: Server-Side Template Injection (SSTI) leading to Remote Code Execution (RCE) in Agent "Text Processing" Component	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published04/03/2026	SeverityHigh
`CVE-2026-24770`RAGFlow Affected by Zip Slip Remote Code Execution (RCE) in MinerUParser	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published01/27/2026	SeverityCritical
`CVE-2025-69286`RAGFlow has Predictable Token Generation Leading to Authentication Bypass Vulnerability	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published12/31/2025	SeverityHigh
`CVE-2025-68700`RAGFlow Remote Code Execution Vulnerability	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published12/31/2025	SeverityHigh
`CVE-2025-51462`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published07/22/2025	SeverityMedium
`CVE-2025-48187`	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published05/17/2025	SeverityCritical
`CVE-2024-12779`SSRF in infiniflow/ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityMedium
`CVE-2024-12869`Improper Authentication in infiniflow/ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityMedium
`CVE-2024-12871`Stored Cross-site Scripting (XSS) in infiniflow/ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityMedium
`CVE-2024-12450`RCE, Full Read SSRF, and Arbitrary File Read in infiniflow/ragflow	Exploitation statusPublic exploit	FixYes	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityMedium
`CVE-2024-12870`Stored Cross-site Scripting (XSS) in infiniflow/ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityMedium
`CVE-2024-12433`Remote Code Execution in infiniflow/ragflow	Exploitation statusPublic exploit	FixYes	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityCritical
`CVE-2024-12880`Partial Account Takeover due to Insecure Data Querying in infiniflow/ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productinfiniflow/ragflow	Published03/20/2025	SeverityHigh
`CVE-2025-27135`RAGFlow SQL Injection vulnerability	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published02/25/2025	SeverityHigh
`CVE-2025-25282`Potential Insecure Direct Object Reference (IDOR) vulnerability in ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productragflow	Published02/21/2025	SeverityHigh
`CVE-2024-53450`	Exploitation statusPublic exploit	FixNot confirmed	Affected productNot confirmed	Published12/09/2024	SeverityHigh
`CVE-2024-10131`Remote Code Execution in infiniflow/ragflow	Exploitation statusPublic exploit	FixNot confirmed	Affected productinfiniflow/ragflow	Published10/19/2024	SeverityHigh

21 / 21 Results

All vulnerabilities loaded

Security vulnerabilities from infiniflow

infiniflow

Filters

Run an in-depth assessment with complete web risk management

Popular infiniflow products

ragflow

infiniflow/ragflow

How many security vulnerabilities does infiniflow have?

Which infiniflow product has the most security vulnerabilities?