CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

502 matches found

Cvelist•added 2026/02/02 10:36 a.m.•49 views

CVE-2024-2356 Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui

A Local File Inclusion LFI vulnerability exists in the '/reinstallextension' endpoint of the parisneo/lollms-webui application, specifically within the name parameter of the @router.post"/reinstallextension" route. This vulnerability allows attackers to inject a malicious name parameter, leading ...

9.6CVSS0.00898EPSS

SaveExploits0References2

Rapid7 Vulnerability Database (full)•added 2026/02/02 12:00 a.m.•5 views

CVE-2026-1117: Improper Access Control

A vulnerability in the lollmsgenerationevents.py component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events. The addevents function registers event handlers such as generatetext, cancelgeneration, generatemsg, and generatemsgfrom without implementing...

8.2CVSS7.7AI score0.00594EPSS

SaveExploits0References1

Rapid7 Vulnerability Database (full)•added 2026/02/02 12:00 a.m.•12 views

CVE-2024-2356: Path Traversal: '\..\filename'

9.6CVSS8.3AI score0.00898EPSS

SaveExploits0References1

Positive Technologies•added 2026/01/08 12:00 a.m.•28 views

PT-2026-31070

Name of the Vulnerable Software and Affected Versions parisneo/lollms affected versions not specified Description The application does not invalidate active sessions after a password reset, allowing an attacker to continue using an old session token. This is due to a lack of logic to reject...

4.6CVSS5.4AI score0.00227EPSS

SaveExploits0References15

RedhatCVE•added 2026/01/07 9:09 a.m.•27 views

CVE-2024-2362

A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform. Due to improper validation of file paths between Windows and Linux environments, an attacker can exploit this vulnerability to delete any file on the system. The issue arises from the lack of...

9.1CVSS7.9AI score0.0115EPSS

SaveExploits1References1

RedhatCVE•added 2026/01/07 9:09 a.m.•23 views

CVE-2024-2366

A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstallbinding functionality in lollmscore/lollms/server/endpoints/lollmsbindinginfos.py of the latest version. The vulnerability arises due to insufficient path sanitization, allowing...

9CVSS9.4AI score0.00662EPSS

SaveExploits1References1

RedhatCVE•added 2026/01/07 9:08 a.m.•23 views

CVE-2024-2358

A path traversal vulnerability in the '/applysettings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code. The vulnerability arises due to insufficient sanitization of user-supplied input in the configuration settings, specifically within the 'extensions' parameter...

9.8CVSS8.9AI score0.01123EPSS

SaveExploits1References1