SQL Injection

Overview llama-index-core is an Interface between LLMs and your data Affected versions of this package are vulnerable to SQL Injection in the defaultjsonalyzer function, which may allow arbitrary file writes or denial of service by occupying database resources. An attacker who can inject SQL into...

CVE-2024-12389

A path traversal vulnerability exists in binary-husky/gptacademic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction...

CVE-2024-12389

A path traversal vulnerability exists in binary-husky/gptacademic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction...

CVE-2024-12389 Path Traversal in binary-husky/gpt_academic

A path traversal vulnerability exists in binary-husky/gptacademic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction...

CVE-2024-12389 Path Traversal in binary-husky/gpt_academic

A path traversal vulnerability exists in binary-husky/gptacademic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction...

CVE-2024-12389

A path traversal vulnerability exists in binary-husky/gptacademic version git 310122f. The application supports the extraction of user-provided 7z files without proper validation. The Python py7zr package used for extraction does not guarantee that files will remain within the intended extraction...

CVE-2024-12389

CVE-2024-12389 affects binary-husky/gpt_academic (version git 310122f). A path traversal flaw arises when extracting user-provided 7z archives with the Python py7zr library, which does not guarantee containment within the intended extraction directory. This can enable arbitrary file writes and po...

CVE-2024-12390 Remote Code Execution in binary-husky/gpt_academic

A vulnerability in binary-husky/gptacademic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. Th...

CVE-2024-12390

A vulnerability in binary-husky/gptacademic version git 310122f allows for remote code execution. The application supports the extraction of user-provided RAR files without proper validation. The Python rarfile module, which supports symlinks, can be exploited to perform arbitrary file writes. Th...

CVE-2024-12390

The CVE-2024-12390 entry concerns binary-husky/gpt_academic (version git 310122f). The vulnerability arises during extraction of user-supplied RAR files without proper validation. Exploitation relies on the Python rarfile module (which supports symlinks) to perform arbitrary file writes, enabling...

Gluon CV Toolkit 输入验证错误漏洞

Gluon CV Toolkit is an open source tool from Distributed Machine Learning Community. An input validation error vulnerability exists in Gluon CV Toolkit version 0.10.0, which stems from an uncleaned tar.gz file download and extraction, and could lead to arbitrary file writes...

GPT Academic 安全漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a path traversal vulnerability that stems from an unverified 7z file extraction, which can be exploited by an attacker to perform arbitrary file writes, leadi...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from an improperly handled file path in the downloadmodel endpoint, which could lead to arbitrary file writes...

LibreChat 安全漏洞

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from a path traversal vulnerability that stems from the program failing to properly filter special elements in the path of a resource or file, which can be exploited by an attacker to cause arbitrary file writes and remote code execution...

Devika 路径遍历漏洞

Devika is an advanced AI software engineer open-sourced by stition. It can understand advanced human instructions, break them down into steps, study the relevant information, and write code to achieve a given goal. Devika suffers from a path traversal vulnerability that stems from allowing...

Open WebUI 路径遍历漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A path traversal vulnerability exists in Open WebUI version 0.3.8, which stems from improper handling of filenames in the /models/upload endpoint, which could lead to arbitrary file writes...

DB-GPT 代码问题漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A code issue vulnerability exists in DB-GPT version v0.6.0, which stems from the web API POST /api/v1/editor/chart/run allows the execution of arbitrary SQL queries, which allows an...

PT-2025-12125

Name of the Vulnerable Software and Affected Versions dmlc/gluon-cv version 0.10.0 Description A vulnerability in the ImageClassificationDataset.from csv API allows for arbitrary file write. The function downloads and extracts tar.gz files from URLs without proper sanitization, making it...

PT-2025-12073

Name of the Vulnerable Software and Affected Versions eosphoros-ai/db-gpt version v0.6.0 Description The issue allows execution of arbitrary SQL queries without access control through the web API endpoint POST /api/v1/editor/sql/run. This can be exploited to perform Arbitrary File Write using...

CVE-2025-27787 Applio allows a DoS in restart.py

Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service DoS in restart.py. modelname in train.py takes user input, and passes it to the stoptrain function in restart.py, which uses it construct a path to a folder with config.json. That config.json is...