CVE-2024-3126

CVE-2024-3126 concerns the parisneo/lollms-webui project, specifically the bug in the Python file lollms_xtts.py and the function run_xtts_api_server. The issue stems from constructing an OS command with a Python f-string and passing xtts_base_url to subprocess.Popen without adequate input saniti...

CVE-2024-2358 Path Traversal leading to Remote Code Execution in parisneo/lollms-webui

A path traversal vulnerability in the '/applysettings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter...

CVE-2024-4322 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the /listpersonalities endpoint. By manipulating the category parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version...

CVE-2024-4322

The CVE-2024-4322 issue affects parisneo/lollms-webui, specifically the /list_personalities endpoint. The vulnerability arises from improper handling of user-controlled input in the category parameter, enabling path traversal to list arbitrary directories on the host. Reports across multiple sour...

CVE-2024-4322 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the /listpersonalities endpoint. By manipulating the category parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version...

CVE-2024-2358

The CVE-2024-2358 path-traversal vulnerability affects parisneo/lollms-webui, exposed via the /apply_settings endpoint where unsanitized user input in the extensions parameter enables navigation to arbitrary directories. An attacker could craft a payload with ../../../ sequences to load and execu...

LoLLMs Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A command injection vulnerability exists in LoLLMs that stems from a remote code execution vulnerability in the reinstallbinding function in...

PT-2024-23903 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions prior to 9.5 Description: A command injection issue exists due to the improper neutralization of special elements in an OS command within the run xtts api server function of the lollms xtts.py script. This allow...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to 9.5, which stems from insufficient cleanup of the config parameter in the /applysettings function, allowing an attacker to manipulate...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from the installmodel function in lollmscore/lollms/binding.py that does not properly clean up the file protocol and other inputs, resulting...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from mishandling of user-supplied input in the listpersonalities function, allowing an attacker to traverse the directory structure and list...

PT-2024-30383

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version affected versions not specified Description A path traversal issue exists, specifically within the "/list personalities" endpoint, allowing an attacker to traverse the directory structure by manipulating the...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs that stems from insufficient cleanup of user-supplied input in configuration settings, allowing an attacker to execute arbitrary code...

LoLLMs Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. LoLLMs suffers from a command injection vulnerability that stems from insufficient cleanup of user input, leading to arbitrary code execution...

PT-2024-25806 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions prior to 9.5 Description: A path traversal issue exists in the "save settings" endpoint due to insufficient sanitization of the config parameter in the apply settings function. This allows an attacker to...

LoLLMs Security Vulnerabilities

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs versions prior to 9.3, which stems from insufficient protection of the /applysettings and /executecode endpoints, allowing remote attackers to execute...

LoLLMs Operating System Command Injection Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. An operating system command injection vulnerability exists in LoLLMs versions prior to 9.5 that stems from incorrect neutralization of special elements used in operating system commands, allowi...

PT-2024-29038

Name of the Vulnerable Software and Affected Versions parisneo/lollms version latest Description The issue is related to arbitrary code execution due to insufficient sanitization of user input. Specifically, the /unInstall binding endpoint is vulnerable, and the problem arises from the lack of pa...

LoLLMs 跨站脚本漏洞

LoLLMs is a web UI for large language multimodal systems by Saifeddine ALOUI individual developer. LoLLMs suffers from a cross-site scripting vulnerability that can be exploited by an attacker to execute arbitrary Web script or HTML by injecting a crafted payload...

CVE-2024-2299

CVE-2024-2299 describes a stored XSS in the parisneo/lollms-webui profile picture upload due to improper validation of uploaded files. The vulnerability can be triggered by uploading malicious HTML files containing JavaScript, which executes when accessed. It is remotely exploitable via CSRF, ena...