71 matches found
CVE-2025-62505 SSRF in lobehub/lobe-chat with native web fetch module
LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...
CVE-2025-62505 SSRF in lobehub/lobe-chat with native web fetch module
LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...
EUVD-2025-34905
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module...
PT-2025-42638
Name of the Vulnerable Software and Affected Versions LobeChat versions prior to 1.136.2 Description LobeChat is susceptible to a server-side request forgery SSRF issue within the tools.search.crawlPages tRPC endpoint. An attacker can provide arbitrary URLs and specify the 'naive' implementation,...
CVE-2025-62505: Server-Side Request Forgery (SSRF)
LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...
LobeChat < 0.162.25 Sensitive Data Exposure
According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 0.162.25. It is, therefore, affected by a Sensitive Data Exposure through SSO/Access Code. Note that the scanner has not tested for these issues but has instead relie...
LobeChat Detected
This is an informational plugin to inform the user that the scanner has detected a publicly accessible LobeChat instance on the target application. LobeChat is an open-source, AI chat framework that supports multi AI providers. This detection is included in the AI and LLM category. No source data...
LobeChat < 0.150.6 Server-Side Request Forgery
According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 0.150.6. It is, therefore, affected by a Server-Side Request Forgery through agent proxy configuration. Note that the scanner has not tested for these issues but has...
LobeChat < 0.122.4 Improper Access Control
According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 0.122.4. It is, therefore, affected by an Improper Access Control allowing access plugins without proper authorization. Note that the scanner has not tested for these...
LobeChat < 1.19.13 Server-Side Request Forgery
According to the self-reported version in its response header, the version of LobeChat hosted on the remote web server is prior to 1.19.13. It is, therefore, affected by multiples Server-Side Request Forgery : - A Server-Side Request Forgery through proxy address - A Server-Side Request Forgery...
