https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-58434.yaml

标题： Flowise 访问控制错误漏洞 (CVE-2025-58434)
描述：Flowise是FlowiseAI开源的一个用于轻松构建 LLM 应用程序的工具。 Flowise 3.0.5及之前版本存在访问控制错误漏洞，该漏洞源于forgot-password端点未经验证返回密码重置令牌，可能导致账户接管。

Flowise versions 3.0.5 and earlier had a vulnerability in the forgot-password endpoint, which returned valid reset tokens without authentication—allowing attackers to reset passwords and take over accounts.

 id: CVE-2025-58434

info:
  name: Flowise <= 3.0.5 - Account Takeover
  author: nukunga[seunghyeonJe

...