CVE-2024-8581 Path Traversal in parisneo/lollms-webui

A vulnerability in the uploadapp function of parisneo/lollms-webui V12 Strawberry allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the filename value, causing a Path Traversal error...

CVE-2024-8581

CVE-2024-8581 concerns parisneo/lollms-webui, version V12 (Strawberry). The vulnerability is in the upload_app function where unsanitized filename input enables Path Traversal, allowing an attacker to delete arbitrary files or directories on the host. Root cause: lack of user input filtering for ...

CVE-2024-8581 Path Traversal in parisneo/lollms-webui

A vulnerability in the uploadapp function of parisneo/lollms-webui V12 Strawberry allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the filename value, causing a Path Traversal error...

CVE-2024-11302 Missing check_access in lollms_binding_infos in parisneo/lollms

A missing checkaccess function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI v9.9 to the latest version, which stems from a directory listing vulnerability that allows an attacker to list arbitrary...

LoLLMs 代码注入漏洞

LoLLMs is a large language and multimodal system by the individual developer Saifeddine ALOUI. A code injection vulnerability exists in LoLLMs version 9.8, which stems from the use of the eval function in the Calculate function and could lead to remote code execution...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by Saifeddine ALOUI Individual Developer. A security vulnerability exists in LoLLMs Web UI version V13, which stems from a lack of authentication checks in the offload endpoint and could lead to unauthorized director...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from multiple file upload endpoints that do not properly handle CSRF protection, potentially...

LoLLMs Web UI 代码注入漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A code injection vulnerability exists in LoLLMs Web UI version V12, which stems from the uploadapp function not filtering user input, which could result in a path travers...

PT-2025-12241 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version V12 Strawberry Description: A Denial of Service DoS issue exists due to the application's handling of multipart boundaries in file upload endpoints. Despite CSRF protection, the server processes these boundaries,...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by Saifeddine ALOUI Individual Developer. A security vulnerability exists in LoLLMs Web UI version V13, which originates from an unauthenticated URL and could lead to a server-side request forgery attack...

LoLLMs Web UI 资源管理错误漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A resource management error vulnerability exists in LoLLMs Web UI version v13, which stems from a denial-of-service attack that could result from improper handling of...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from the install and uninstall API endpoints not being adequately cleaned of user input,...

LoLLMs 跨站脚本漏洞

LoLLMs is a large language and multimodal system by the individual developer Saifeddine ALOUI. A cross-site scripting vulnerability exists in LoLLMs version 9.8, which stems from improper use of the v-html directive on the Settings page and could lead to a cross-site scripting attack...

LoLLMs 安全漏洞

LoLLMs is a large language and multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs version V14, which stems from the lack of a checkaccess function, which allows an attacker to add, modify and delete bindings at will...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from the startappserver function not properly cleaning up the appname parameter, which could lea...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A path traversal vulnerability exists in LoLLMs v12, which stems from path traversal in the /wipedatabase endpoint and could lead to arbitrary directory deletion...

LoLLMs Web UI 代码问题漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by Saifeddine ALOUI Individual Developer. A code issue vulnerability exists in LoLLMs Web UI version v12, which stems from the Send file to AL feature that allows uploading of dangerous files, which could lead to...

CVE-2024-3435

A path traversal vulnerability exists in the 'savesettings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the 'applysettings' function, allowing an...

CVE-2024-3429

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises...