CVE-2024-6986: Improper Neutralization of Input During Web Page Generation

A Cross-site Scripting XSS vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'fulltemplate' variable directly as HTML. This allows an attacker to execute maliciou...

PT-2025-12238

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 Strawberry Description The issue concerns a function named upload app that does not properly filter user input for the filename value, leading to a Path Traversal error. This allows an attacker to delete any...

PT-2025-12321

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version v13 Description A vulnerability arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowin...

PT-2025-12297

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V13 Description A missing authentication check in the uninstall endpoint allows attackers to perform unauthorized directory deletions. The "/uninstall/app name" API endpoint does not call the check access function...

PT-2025-12144

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V13 feather Description The issue is a Server-Side Request Forgery SSRF vulnerability in the "POST /api/proxy" REST API. Attackers can exploit this to access unauthorized web resources by specifying the JSON...

PT-2025-12184

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui versions v10 through latest Description A vulnerability in the sanitize path function allows an attacker to bypass path sanitization by using relative paths such as './'. This can lead to unauthorized access to directorie...

PT-2025-12248

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 Strawberry Description A path traversal issue exists in the API endpoints for installation and uninstallation. This allows attackers to create or delete directories with arbitrary paths on the system. The...

CVE-2024-12766: Server-Side Request Forgery (SSRF)

parisneo/lollms-webui version V13 feather suffers from a Server-Side Request Forgery SSRF vulnerability in the POST /api/proxy REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter...

CVE-2024-11302: Missing Critical Step in Authentication

A missing checkaccess function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized...

LoLLMs 跨站脚本漏洞

LoLLMs is a large language and multimodal system by the individual developer Saifeddine ALOUI. A cross-site scripting vulnerability exists in LoLLMs version 9.8, which stems from improper use of the v-html directive on the Settings page and could lead to a cross-site scripting attack...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by Saifeddine ALOUI Individual Developer. A security vulnerability exists in LoLLMs Web UI version V13, which originates from an unauthenticated URL and could lead to a server-side request forgery attack...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI v9.9 to the latest version, which stems from a directory listing vulnerability that allows an attacker to list arbitrary...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from the install and uninstall API endpoints not being adequately cleaned of user input,...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from multiple file upload endpoints that do not properly handle CSRF protection, potentially...

PT-2025-12241 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version V12 Strawberry Description: A Denial of Service DoS issue exists due to the application's handling of multipart boundaries in file upload endpoints. Despite CSRF protection, the server processes these boundaries,...

LoLLMs Web UI 资源管理错误漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A resource management error vulnerability exists in LoLLMs Web UI version v13, which stems from a denial-of-service attack that could result from improper handling of...

LoLLMs Web UI 代码注入漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A code injection vulnerability exists in LoLLMs Web UI version V12, which stems from the uploadapp function not filtering user input, which could result in a path travers...

LoLLMs 路径遍历漏洞

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A path traversal vulnerability exists in LoLLMs v12, which stems from path traversal in the /wipedatabase endpoint and could lead to arbitrary directory deletion...

PT-2025-12286

Name of the Vulnerable Software and Affected Versions parisneo/lollms version v12 Description A Path Traversal issue exists in the "/wipe database" endpoint, allowing an attacker to delete any directory on the system. This is due to improper validation of the key parameter, which is used to...

CVE-2024-9597: Improper Limitation of a Pathname to a Restricted Directory

A Path Traversal vulnerability exists in the /wipedatabase endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the key parameter, which is used to construct file paths. An attacker can exploit th...