CVE-2024-12374 Stored XSS in automatic1111/stable-diffusion-webui

A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...

Stable Diffusion web UI 资源管理错误漏洞

Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. A resource management error vulnerability exists in Stable Diffusion web UI version 1.10.0, which stems from improper handling of form-data in a file upload request and could lead to a denial of service attack...

Stable Diffusion web UI 跨站脚本漏洞

Stable Diffusion web UI is a web interface by the individual developer of AUTOMATIC1111. A cross-site scripting vulnerability exists in the Stable Diffusion web UI that originates from an HTML file upload and could lead to a stored cross-site scripting attack...

PT-2025-12097 · Unknown · Automatic1111/Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: A Cross-Site WebSocket Hijacking CSWSH vulnerability allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability is due to a lack of...

Stable Diffusion web UI 安全漏洞

Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. A security vulnerability exists in the Stable Diffusion web UI that originates from a specially crafted request and could lead to a local file inclusion attack...

PT-2025-12080 · Unknown · Automatic1111/Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: The software is susceptible to a flaw where the server does not properly manage extra characters added to the end of multipart boundaries. This can be exploited by sending...

Stable Diffusion web UI 资源管理错误漏洞

Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. A resource management error vulnerability exists in Stable Diffusion web UI version 1.10.0, which stems from the server's failure to handle excessive characters at the end of multi-part boundaries, which could lea...

PT-2025-12123 · Unknown · Automatic1111/Stable-Diffusion-Webui

Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: A Denial of Service DoS vulnerability exists in the file upload feature. The issue is due to improper handling of form-data with a large filename in the file upload request...

Stable Diffusion web UI 输入验证错误漏洞

Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. An input validation error vulnerability exists in Stable Diffusion web UI version 1.10.0, which stems from an open redirection vulnerability that could lead to phishing attacks, malware distribution, and credentia...

Stable Diffusion web UI 访问控制错误漏洞

Stable Diffusion web UI is a web interface for AUTOMATIC1111 individual developers. An access control error vulnerability exists in Stable Diffusion web UI version 1.10.0, which stems from a cross-site WebSocket hijacking vulnerability that could lead to unauthorized operations...

CVE-2024-32022

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to command injection in basiccaptiongui.py. This vulnerability is fixed in 23.1.5...

CVE-2024-32027

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass v22.6.1 is vulnerable to command injection in finetunegui.py This vulnerability is fixed in 23.1.5...

CVE-2024-32027 Kohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass v22.6.1 is vulnerable to command injection in finetunegui.py This vulnerability is fixed in 23.1.5...

CVE-2024-32027 Kohya_ss is vulnerable to a command injection in `finetune_gui.py` (`GHSL-2024-022`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass v22.6.1 is vulnerable to command injection in finetunegui.py This vulnerability is fixed in 23.1.5...

CVE-2024-32025 Kohya_ss is vulnerable to a command injection in `group_images_gui.py` (`GHSL-2024-021`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a command injection in groupimagesgui.py. This vulnerability is fixed in 23.1.5...

CVE-2024-32024 Kohya_ss vulenrable to path injection in `common_gui.py` `add_pre_postfix` function (`GHSL-2024-023`)

Kohyass is a GUI for Kohya's Stable Diffusion trainers. Kohyass is vulnerable to a path injection in the commongui.py addprepostfix function. This vulnerability is fixed in 23.1.5...

CVE-2024-31462

stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The createui method Backup/Restore tab in modules/uiextensions.py takes user input into the configsavenam...

CVE-2024-31462 Limited file write in Stable-diffusion-webui - GHSL-2024-010

stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The createui method Backup/Restore tab in modules/uiextensions.py takes user input into the configsavenam...

CVE-2024-31462 Limited file write in Stable-diffusion-webui - GHSL-2024-010

stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The createui method Backup/Restore tab in modules/uiextensions.py takes user input into the configsavenam...

CVE-2024-31462

The CVE-2024-31462 entry concerns stable-diffusion-webui (v1.7.0) with a limited file write vulnerability. The root cause is in the create_ui function (Backup/Restore tab) within modules/ui_extensions.py, where user input is captured into config_save_name and later used to form a file path that i...