5089 matches found
CVE-2025-65230
Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting XSS vulnerability in the Web UI Configuration Streaming Destination input...
Barix Instreamer 安全漏洞
Barix Instreamer is an audio encoding device from the Swiss company Barix. A security vulnerability exists in Barix Instreamer v04.06 and earlier versions, which originates from the presence of stored cross-site scripting in the Web UI I/O and Serial Configuration pages...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Summary A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as...
CVE-2025-33203
NVIDIA NeMo Agent Toolkit UI for Web is affected by a Server-Side Request Forgery in the chat API endpoint (likely /chat). The root cause is a vulnerability in the chat API that may allow an attacker to induce information disclosure and denial of service. Public documentation in connected sources...
CVE-2025-36153
IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2025-36153 IBM Concert Cross-Site Scripting
IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...
CVE-2025-12487 oobabooga text-generation-webui trust_remote_code Reliance on Untrusted Inputs Remote Code Execution Vulnerability
oobabooga text-generation-webui trustremotecode Reliance on Untrusted Inputs Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of oobabooga text-generation-webui. Authentication is not required to exploit this...
GHSA-2QFP-Q593-8484 vulnerabilities
Vulnerabilities for packages: mitmproxy...
GHSA-2QFP-Q593-8484 vulnerabilities
Vulnerabilities for packages: superset, pgadmin4, nemo, mitmproxy...
EUVD-2025-37985
IBM Business Automation Workflow containers 24.0.0 through 24.0.0-IF006, 24.0.1 through 24.0.1-IF004, 25.0.0 through 25.0.0-IF001 and IBM Business Automation Workflow traditional with Process Federation Server 24.0.0 through 24.0.1 and 25.0.0 are vulnerable to cross-site scripting. This...
Text Generation Web UI 安全漏洞
Text Generation Web UI is a UI interface for native AI by oobabooga individual developers. A security vulnerability exists in Text Generation Web UI that stems from improper handling of the trustremotecode parameter, which could lead to remote code execution...
Text Generation Web UI 安全漏洞
Text Generation Web UI is a UI interface for native AI by oobabooga individual developers. A security vulnerability exists in Text Generation Web UI that stems from improper handling of the trustremotecode parameter in the load endpoint, which could lead to remote code execution...
CVE-2025-20376
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a...
EUVD-2025-37888
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to specific UI features. An attacker could exploit this vulnerability by uploading a...
Unspecified vulnerability in Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 (CNVD-2025-27469)
The Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4 are both networked access controllers from Azure Access Technology, USA. A security vulnerability exists in Azure Access Technology BLU-IC2 and Azure Access Technology BLU-IC4, which can be exploited by an attacker to cause a...
PT-2025-45133
A vulnerability in the web UI of Cisco Unified CCX could allow an authenticated, remote attacker to upload and execute arbitrary files. This vulnerability is due to an insufficient input validation associated to file upload mechanisms. An attacker could exploit this vulnerability by uploading a...
EUVD-2025-37552
IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 001, 24.0.1 through 24.0.1 Interim Fix 004, 24.0.0 through 24.0.0 Interim Fix 006, and earlier unsupported releases IBM Business Automation Workflow is vulnerable to stored cross-site scripting. This vulnerability allows an...