1553 matches found
POC_CVE-2024-12537
CVE-2024-12537 Lab DoS sul Formato Codice di Open WebUI Questo repository contiene un laboratorio di riproduzione locale e isolato e un candidato template nuclei per CVE-2024-12537, una vulnerabilità di denial-of-service non autenticata nell'endpoint di formattazione del codice di Open WebUI. Il...
CVE-2026-70481
CVE-2026-70481 Open WebUI, interessato nelle versioni dalla 0.5.0 alla 0.10.2, corretto nella 0.11.0. Gravità moderata, CVSS 5.4, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, CWE-284 e CWE-862. In backend/openwebui/routers/channels.py i gestori di aggiornamento ed eliminazione dei messaggi si...
Open WebUI < 0.9.5 - Information Disclosure
Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...
Open WebUI 'LDAP Empty Password' - Authentication Bypass
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...
CVE-2024-7808
CVE-2024-7808 💀 $$\colorred QUESTO \space EXPLOIT \space POTREBBE \space VIOLARE \space LA \space LEGGE.$$ $$\colorred\space SEI \space RESPONSABILE \space DELLE \space TUE \space AZIONI.$$ $$\colorred SOLO \space A \space SCOPO \space DIMOSTRATIVO.$$ DESCRIZIONE RCE da parte di utenti non...
enforcement-coverage
تغطية الإنفاذ تكتشف مسارات API التي تحمل تحكمًا في التفويض أضعف من مساراتها الشقيقة. عثرت على CVE-2026-45316 في Open WebUI من الكود المصدري وحده، دون أي معرفة مسبقة بنشرة أمنية: root@kitploit: MISMATCH POST /notes/id/pin notes.py:pinnotebyid 3/3 comparable write operations on note require...
CVE-2025-64495-POC
CVE-2025-64495-POC Open WebUI vulnerabile a Stored DOM XSS tramite prompt quando 'Insert Prompt as Rich Text' è abilitato, con conseguente ATO/RCE Riepilogo La funzionalità che inserisce prompt personalizzati nella finestra di chat è vulnerabile a DOM XSS quando 'Insert Prompt as Rich Text' è...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
CVE-2026-59714
CVE-2026-59714 describes a cross-channel message overwrite vulnerability in Open WebUI exposed by the chat-completions path. From v0.9.5 to before v0.10.0, an authenticated user could overwrite a message in a channel they do not belong to by using a channel: chat_id with a caller-supplied message...
CVE-2026-59714 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a...
GHSA-FP3F-MC75-235C vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-FWG2-594C-JP42 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71852 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-71870 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2026-12075 vulnerabilities
Vulnerabilities for packages: open-webui...
GHSA-XH95-F55M-82FW vulnerabilities
Vulnerabilities for packages: open-webui...