5553 matches found
CVE-2024-12864 Unauthenticated DoS by Sending Large Filename at File Upload Endpoint in netease-youdao/qanything
A Denial of Service DoS vulnerability was discovered in the file upload feature of netease-youdao/qanything version v2.0.0. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a large...
CVE-2025-0191
CVE-2025-0191 affects gaizhenbiao/chuanhuchatgpt (v20240914). The DoS arises from improper handling of form-data with an oversized filename in the file-upload function. A payload with a very large filename can overwhelm the server, making it unresponsive and unavailable to legitimate users. The C...
CVE-2024-9229
CVE-2024-9229 affects the Quivr project (stangirard/quivr) v0.0.298, with a DoS caused by unauthenticated attackers who append characters to the end of a multipart boundary during file uploads. The vulnerability triggers continuous processing per character, leading to high resource consumption an...
CVE-2025-0187 Denial of Service (DoS) by Sending Large Filename at File Upload Endpoint in gradio-app/gradio
A Denial of Service DoS vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. By sending a payload with an excessively large filename, the server...
CVE-2025-0187
The CVE-2025-0187 concerns gradio-app/gradio 0.39.1, where the file upload endpoint mishandles form-data with an excessively large filename. This causes a DoS by overwhelming the server, leading to unavailability for legitimate users. The vulnerability is tied to the /upload handling and results ...
CVE-2024-10714 Denial of Service in binary-husky/gpt_academic
A vulnerability in binary-husky/gptacademic version 3.83 allows an attacker to cause a Denial of Service DoS by adding excessive characters to the end of a multipart boundary during file upload. This results in the server continuously processing each character and displaying warnings, rendering t...
CVE-2024-11033 Denial of Service (DoS) in binary-husky/gpt_academic
A Denial of Service DoS vulnerability exists in the file upload feature of binary-husky/gptacademic version 3.83. The vulnerability is due to improper handling of form-data with a large filename in the file upload request. An attacker can exploit this vulnerability by sending a payload with an...
CVE-2024-11033
CVE-2024-11033 affects binary-husky/gpt_academic v3.83, where the file upload feature mishandles form-data with an excessively large filename. Reported impact is a DoS, making the server unavailable for legitimate users due to resource exhaustion. The available connected documents confirm the aff...
CVE-2024-6583 Path Traversal in stangirard/quivr
A path traversal vulnerability exists in the latest version of stangirard/quivr. This vulnerability allows an attacker to upload files to arbitrary paths in an S3 bucket by manipulating the file path in the upload request...
CVE-2024-6583
CVE-2024-6583 describes a path traversal vulnerability in the latest version of stangirard/quivr, enabling an attacker to upload files to arbitrary paths in an S3 bucket by manipulating the upload request path. The root cause is related to insufficient validation of the destination path in the up...
CVE-2024-11171 Improper Input Validation in danny-avila/librechat
In danny-avila/librechat version git 0c2a583, there is an improper input validation vulnerability. The application uses multer middleware for handling multipart file uploads. When using in-memory storage the default setting for multer, there is no limit on the upload file size. This can lead to a...
CVE-2024-9920
CVE-2024-9920 affects parisneo/lollms-webui (v12). The vulnerability occurs in the “Send file to AL” feature, which accepts file uploads with extensions such as .py/.sh/.bat and then can execute them via the /open_file endpoint. Root cause: files are opened with subprocess.Popen without proper va...
CVE-2024-9920 Unrestricted File Upload and Execution in parisneo/lollms-webui
In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the '/openfile' API...
CVE-2024-4023 Stored XSS in flatpressblog/flatpress
A stored cross-site scripting XSS vulnerability exists in flatpressblog/flatpress version 1.3. When a user uploads a file with a .xsig extension and directly accesses this file, the server responds with a Content-type of application/octet-stream, leading to the file being processed as an HTML fil...
CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
A vulnerability in the file upload functionality of the FlatPress CMS admin panel version latest allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting XSS attack if the uploaded file is accessed by other users. The issue is...
CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
A vulnerability in the file upload functionality of the FlatPress CMS admin panel version latest allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting XSS attack if the uploaded file is accessed by other users. The issue is...
CVE-2024-9699 Cross-Site Scripting (XSS) in flatpressblog/flatpress
A vulnerability in the file upload functionality of the FlatPress CMS admin panel version latest allows an attacker to upload a file with a JavaScript payload disguised as a filename. This can lead to a Cross-Site Scripting XSS attack if the uploaded file is accessed by other users. The issue is...
CVE-2024-10902
CVE-2024-10902 concerns eosphoros-ai/db-gpt v0.6.0. The web API endpoint POST /v1/personal/agent/upload is described as vulnerable to Arbitrary File Upload with Path Traversal , enabling an attacker to upload files to arbitrary locations on the victim’s file system. Impact telegraphs possible rem...
CVE-2024-10831 Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gpt
In eosphoros-ai/db-gpt version 0.6.0, the endpoint for uploading files is vulnerable to absolute path traversal. This vulnerability allows an attacker to upload arbitrary files to arbitrary locations on the target server. The issue arises because the filekey and docfile.filename parameters are...