641 matches found
CVE-2025-8848
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response. This can lead to potential security...
CVE-2025-8848
LibreChat (danny-avila/librechat) v0.7.9 contains a vulnerability where the Accept-Language header is not properly sanitized, allowing a logged-in attacker to inject arbitrary HTML into the html lang tag, effectively a stored XSS risk as described by multiple sources (NVD, Nuclei template, OSV, R...
CVE-2025-8848 HTML Injection in Accept-Language Header in danny-avila/librechat
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response. This can lead to potential security...
CVE-2025-8848 HTML Injection in Accept-Language Header in danny-avila/librechat
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response. This can lead to potential security...
CVE-2025-8848 HTML Injection in Accept-Language Header in danny-avila/librechat
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response. This can lead to potential security...
LibreChat 代码注入漏洞
LibreChat is an enhanced ChatGPT clone by Danny Avila Personal Developer. A code injection vulnerability exists in LibreChat version 0.7.9, which stems from unvalidated input of the Accept-Language header and could lead to a cross-site scripting attack...
PT-2025-43144
Name of the Vulnerable Software and Affected Versions librechat version 0.7.9 Description A flaw exists in danny-avila/librechat version 0.7.9 that permits HTML injection through the Accept-Language header. A logged-in user sending an HTTP GET request with a specially crafted Accept-Language head...
CVE-2025-8848: Improper Control of Generation of Code
A vulnerability in danny-avila/librechat version 0.7.9 allows for HTML injection via the Accept-Language header. When a logged-in user sends an HTTP GET request with a crafted Accept-Language header, arbitrary HTML can be injected into the tag of the response. This can lead to potential security...
EUVD-2025-31595
Malicious code in bioql PyPI...
EUVD-2025-30885
Malicious code in bioql PyPI...
EUVD-2025-7005
Malicious code in bioql PyPI...
EUVD-2025-23599
Malicious code in bioql PyPI...
EUVD-2025-7108
Malicious code in bioql PyPI...
EUVD-2025-7052
Malicious code in bioql PyPI...
EUVD-2025-7099
Malicious code in bioql PyPI...
EUVD-2025-7104
Malicious code in bioql PyPI...
EUVD-2025-7021
Malicious code in bioql PyPI...
EUVD-2025-7050
Malicious code in bioql PyPI...
CVE-2025-7104
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra...
CVE-2025-7104
A mass assignment vulnerability exists in danny-avila/librechat, affecting all versions. This vulnerability allows attackers to manipulate sensitive fields by automatically binding user-provided data to internal object properties or database fields without proper filtering. As a result, any extra...