Open WebUI Vulnerable to Cross-Site Request Forgery (CSRF)

In version v0.3.8 of open-webui/open-webui, sensitive actions such as deleting and resetting are performed using the GET method. This vulnerability allows an attacker to perform Cross-Site Request Forgery CSRF attacks, where an unaware user can unintentionally perform sensitive actions by simply...

PYSEC-2025-57

A Denial of Service DoS vulnerability in zenml-io/zenml version 0.66.0 allows unauthenticated attackers to cause excessive resource consumption by sending malformed multipart requests with arbitrary characters appended to the end of multipart boundaries. This flaw in the multipart request boundar...

CVE-2024-9340

ZenML vulnerability CVE-2024-9340 affects zenml-io/zenml v0.66.0. unauthenticated attackers can cause DoS by sending malformed multipart requests with extra characters at the end of multipart boundaries, triggering an infinite loop and complete denial of service. Affected endpoints include /api/v...

CVE-2025-2147

A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as problematic. Affected is an unknown function. The manipulation leads to files or directories accessible. It is possible to launch the attack...

CVE-2025-2147

CVE-2025-2147 affects Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. The description indicates that an unknown function can be manipulated to make files or directories accessible, with a remote attacker able to exploit the issue across multiple...

CVE-2024-51144

CVE-2024-51144 : CSRF exists in Ampache <= 6.6.0 via endpoints pvmsg.php?action=add_message, pvmsg.php?action=confirm_delete, and ajax.server.php?page=user&action=flip_follow. The vulnerability, with CVSS v3.1 base score 8.8 (HIGH), requires user interaction and has network attack vector, with...

CVE-2024-10649 Unauthenticated File Upload in wandb/openui

wandb/openui latest commit c945bb859979659add5f490a874140ad17c56a5d contains a vulnerability where unauthenticated endpoints allow file uploads and downloads from an AWS S3 bucket. This can lead to multiple security issues including denial of service, stored XSS, and information disclosure. The...

PT-2024-34379 · Java Shop · Java Shop

Name of the Vulnerable Software and Affected Versions: java shop version 1.0 Description: The issue allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter. This is due to an Incorrect Access Control flaw. Recommendations: For java shop version...

PT-2024-30279 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/admin/view users.php?id=1",...

PT-2024-30290 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/user/transaction.php?id=1",...

PT-2024-3328 · Maccms · Maccms

Name of the Vulnerable Software and Affected Versions: Macs CMS version 1.1.4f Description: The issue is related to a lack of protection against SQL injection attacks when handling certain parameters, including resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole,...

Koha Library Management System Cross-Site Scripting Vulnerability

Library Management System is a library management system with QR code attendance and automatic library card generation by King Albaracin Individual Developer. A cross-site scripting vulnerability exists in Koha Library Management System version 23.05.05 and earlier, which stems from a cross-site...

PT-2024-20369 · Unknown · Library Management System

Name of the Vulnerable Software and Affected Versions: Koha Library Management System versions 23.05.05 and earlier Description: A multiple Cross-site scripting XSS vulnerability in the "/members/moremember.pl" and "/members/members-home.pl" endpoints allows malicious staff users to carry out CSR...

PT-2023-24916 · Unknown · Simple Customer Relationship Management System

Name of the Vulnerable Software and Affected Versions: Simple Customer Relationship Management version 1.0 Description: The issue allows for SQL Injection via the email parameter. Recommendations: For version 1.0, avoid using the email parameter in affected API endpoints until the issue is...