Cross Site Scripting in aiflowy <= 2.1.2

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: MITRE

Description

Cross Site Scripting vulnerability in aiflowy <= 2.1.2 allows a remote attacker to obtain sensitive information via the UploadController.java file

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-52475

Affected Vendors & Products

Vendor	Product	Version / Range
aiflowy	aiflowy	to 2.1.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is a Cross Site Scripting (XSS) issue in the software aiflowy version 2.1.2 or earlier. It allows a remote attacker to inject malicious scripts via the UploadController.java file, potentially stealing sensitive information from users.

Impact Analysis

If you use aiflowy <= 2.1.2, an attacker could exploit this to steal cookies, session tokens, or other sensitive data from users interacting with the application. This could lead to unauthorized access to accounts or data breaches.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (General Data Protection Regulation) due to unauthorized access to personal data. For HIPAA (Health Insurance Portability and Accountability Act), it could expose protected health information, risking compliance.

Hi! I’m here to help you understand CVE-2026-52475. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70