CVE-2025-56527

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...

Cinnamon kotaemon 安全漏洞

Cinnamon kotaemon is a RAG-based open source tool from Cinnamon Open Source. A security vulnerability exists in Cinnamon kotaemon version 0.11.0, which originates from cross-site scripting and could lead to the execution of arbitrary code...

PT-2025-47335

Name of the Vulnerable Software and Affected Versions Kotaemon version 0.11.0 Description A cross site scripting XSS issue exists in Kotaemon version 0.11.0. This allows attackers to execute arbitrary code through a specially crafted PDF file. The issue involves the potential for malicious code...

PT-2025-47336

Name of the Vulnerable Software and Affected Versions Kotaemon version 0.11.0 Description The software stores passwords in plaintext within the client's localStorage. This poses a significant risk as anyone with access to the client's storage can easily retrieve user credentials. Recommendations...

Cinnamon kotaemon 安全漏洞

Cinnamon kotaemon is a RAG-based open source tool from Cinnamon Open Source. A security vulnerability exists in Cinnamon kotaemon version 0.11.0, which originates from storing plaintext passwords in client-side localStorage...

CVE-2025-56527

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...

CVE-2025-56526

Cross site scripting XSS vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF...

CVE-2025-56526: Improper Neutralization of Input During Web Page Generation

Cross site scripting XSS vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF...

CVE-2025-56526

Cross site scripting XSS vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF...

CVE-2025-56526

Kotaemon version 0.11.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to the unsanitized rendering of content extracted from PDF files. Specifically, text, table markings, and image metadata are injected into the DOM without escaping, allowing a crafted PDF to execute arbitrary JavaScrip...

CVE-2025-56526

Cross site scripting XSS vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF...

CVE-2025-56527

Kotaemon version 0.11.0 (including commit 37cdc28 ) is vulnerable to CVE-2025-56527 , where the application stores raw username and password credentials in the client's localStorage . This flaw is located in libs/ktem/ktem/pages/login.py and libs/ktem/ktem/assets/js/main.js. Because these credent...

EUVD-2025-198039

Cross site scripting XSS vulnerability in Kotaemon 0.11.0 allowing attackers to execute arbitrary code via a crafted PDF...

CVE-2025-56527: Plaintext Storage of a Password

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...

CVE-2025-56527

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...

EUVD-2025-198038

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...

CVE-2025-56527

Plaintext password storage in Kotaemon 0.11.0 in the client's localStorage...

CVE-2025-53358

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the indexfn method accepts both URLs and local file paths without validation. The pipeline streams these paths directly and stores them, enabling attackers to...

CVE-2025-53358

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the indexfn method accepts both URLs and local file paths without validation. The pipeline streams these paths directly and stores them, enabling attackers to...

CVE-2025-53358 kotaemon Vulnerable to Path Traversal via Link Upload

kotaemon is an open-source RAG-based tool for document comprehension. From versions 0.10.6 and prior, in libs/ktem/ktem/index/file/ui.py, the indexfn method accepts both URLs and local file paths without validation. The pipeline streams these paths directly and stores them, enabling attackers to...