CVE-2026-52475
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file.
Risk Assessment
An attacker can steal session data or other confidential user information, potentially leading to account takeover or data leakage.
Recommendation
Upgrade aiflowy to a version newer than 2.1.2. Implement input validation and output encoding for all user-supplied data.
Other vulnerabilities in aiflowy
See all- CVE-2026-52476High
SQL Injection vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the getPageData method in the DatacenterQuery.java file.
- CVE-2026-52474High
An issue in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the JobUtil.java file.
Original NVD description (English source)
Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file