5213 matches found
CVE-2024-7959
The Open WebUI SSRF issue is in open-webui/open-webui version 0.3.8, exposed via the /openai/models endpoint. The vulnerable component allows changing the OpenAI URL without validation, causing the server to issue requests to arbitrary destinations and return their output. Reported impact include...
CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting XSS vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious...
CVE-2024-7990
...
CVE-2024-7990
CVE-2024-7990 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
CVE-2024-12374 Stored XSS in automatic1111/stable-diffusion-webui
A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...
CVE-2024-12374
A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...
PT-2025-12080 · Unknown · Automatic1111/Stable-Diffusion-Webui
Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: The software is susceptible to a flaw where the server does not properly manage extra characters added to the end of multipart boundaries. This can be exploited by sending...
PT-2025-12097 · Unknown · Automatic1111/Stable-Diffusion-Webui
Name of the Vulnerable Software and Affected Versions: automatic1111/stable-diffusion-webui version 1.10.0 Description: A Cross-Site WebSocket Hijacking CSWSH vulnerability allows an attacker to clone a malicious server extension from a GitHub repository. The vulnerability is due to a lack of...
CVE-2024-9920: Unrestricted Upload of File with Dangerous Type
In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones like .py, .sh, .bat, and more. Attackers can exploit this by uploading files with malicious content and then using the '/openfile' API...
CVE-2024-8017: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability exists in open-webui/open-webui versions = 0.3.8, specifically in the function that constructs the HTML for tooltips. This vulnerability allows attackers to perform operations with the victim's privileges, such as stealing chat history, deleting chats, and escalating their ow...
编号撤回
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...
PT-2025-12198
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue concerns a Server-Side Request Forgery SSRF vulnerability. Specifically, the /openai/models endpoint is affected, allowing an attacker to change the OpenAI URL to any URL without checks...
PT-2025-12248
Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version V12 Strawberry Description A path traversal issue exists in the API endpoints for installation and uninstallation. This allows attackers to create or delete directories with arbitrary paths on the system. The...
编号撤回
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...
CVE-2024-6986: Improper Neutralization of Input During Web Page Generation
A Cross-site Scripting XSS vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'fulltemplate' variable directly as HTML. This allows an attacker to execute maliciou...
PT-2025-12150
Name of the Vulnerable Software and Affected Versions open-webui version 0.3.32 fastapi versions prior to 0.115.3 Description The issue arises from the application's use of a vulnerable version of the starlette package, which is a dependency of fastapi. This vulnerability can lead to uncontrolled...
PT-2025-12202
Name of the Vulnerable Software and Affected Versions open-webui/open-webui versions = 0.3.8 Description An XSS issue exists, specifically in the function that constructs the HTML for tooltips, allowing attackers to perform operations with the victim's privileges. This includes stealing chat...
PT-2025-12321
Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version v13 Description A vulnerability arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowin...