1553 matches found
CVE-2024-7999
CVE-2024-7999 is rejected/not used; refer to CVE-2024-53981.
CVE-2024-12537
...
CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...
CVE-2024-9840
CVE-2024-9840 is a duplicate of CVE-2024-53981 (per the initial description). Connected data confirms CVE-2024-53981 describes a vulnerability in python-multipart (a streaming multipart parser) with a DoS risk when parsing form data; fixed in version 0.0.18. There is no separate active entry for ...
CVE-2024-7959
The Open WebUI SSRF issue is in open-webui/open-webui version 0.3.8, exposed via the /openai/models endpoint. The vulnerable component allows changing the OpenAI URL without validation, causing the server to issue requests to arbitrary destinations and return their output. Reported impact include...
CVE-2024-7959 SSRF in open-webui/open-webui
The /openai/models endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery SSRF. An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the...
CVE-2024-7990
...
CVE-2024-7990
CVE-2024-7990 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting XSS vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious...
Open WebUI 资源管理错误漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A resource management error vulnerability exists in Open WebUI version v0.3.8, which stems from the use of an overly large name field during registration by an unauthorized user, which may caus...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from an improperly handled file path in the downloadmodel endpoint, which could lead to arbitrary file writes...
PT-2025-12183
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secu...