CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

371 matches found

Cvelist•added 2026/02/02 10:36 a.m.•35 views

CVE-2024-2356 Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui

A Local File Inclusion LFI vulnerability exists in the '/reinstallextension' endpoint of the parisneo/lollms-webui application, specifically within the name parameter of the @router.post"/reinstallextension" route. This vulnerability allows attackers to inject a malicious name parameter, leading ...

9.6CVSS0.00769EPSS

SaveExploits0References2

Positive Technologies•added 2026/01/08 12:00 a.m.•14 views

PT-2026-31070

Name of the Vulnerable Software and Affected Versions parisneo/lollms affected versions not specified Description The application does not invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to a lack of logic to reject...

4.6CVSS6.1AI score0.0021EPSS

SaveExploits0References14

RedhatCVE•added 2026/01/07 9:09 a.m.•14 views

CVE-2024-2362

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

9.1CVSS9.1AI score0.0115EPSS

SaveExploits1References1

RedhatCVE•added 2026/01/07 9:09 a.m.•12 views

CVE-2024-2366

A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstallbinding functionality in lollmscore/lollms/server/endpoints/lollmsbindinginfos.py of the latest version. The vulnerability arises due to insufficient path sanitization, allowing...

9CVSS9.4AI score0.00662EPSS

SaveExploits1References1

RedhatCVE•added 2026/01/07 9:08 a.m.•11 views

CVE-2024-2358

A path traversal vulnerability in the '/applysettings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter...

9.8CVSS8.2AI score0.01123EPSS

SaveExploits1References1