CVE-2025-43846: Deserialization of Untrusted Data

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptpath1 variable takes user input e.g. a path to a model and passes it to the showinfo function in processckpt.py, which uses it to loa...

CVE-2025-43843: Improper Neutralization of Special Elements used in a Command

Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to command injection. The variables expdir1, np7 and f0method8 take user input and pass it into the extractf0feature function, which concatenates them into a command th...

CVE-2025-29446

open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verifyconnection...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the verifyconnection function, by manipulating the backend requests to arbitrary systems. Remediation Upgrade open-webui to version 0.6.34 or higher. References - GitH...

CVE-2025-29446

open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verifyconnection...

CVE-2025-29446

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

CVE-2025-29446

...

CVE-2025-29446

...

PT-2025-17455 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui version 0.5.16 Description: The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is located in the routers/ollama.py file, specifically in the verify connection function. Recommendations: For open-webui version...

Open WebUI 安全漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.5.16, which stems from the vulnerability of the verifyconnection function in routers/ollama.py to a server-side request forgery attack...

CVE-2025-29446

CVE-2025-29446 is associated with Open WebUI 0.5.16, where the SSRF vulnerability resides in routers/ollama.py, function verify_connection. Red Hat’s advisory and Snyk report confirm a Server-Side Request Forgery vulnerability affecting this version and advise upgrading to Open WebUI >= 0.6.34...

CVE-2025-2071

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

CVE-2025-2072

A Reflected Cross-Site Scripting XSS vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a...

CVE-2025-2072

FAST LTA Silent Brick WebUI is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. The issue occurs when user-supplied input is reflected in output without proper sanitization or encoding, enabling arbitrary JavaScript execution in the victim’s browser. Affected WebUI parameters inc...

CVE-2025-2072 Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUI

A Reflected Cross-Site Scripting XSS vulnerability has been discovered in FAST LTA Silent Brick WebUI, allowing attackers to inject malicious JavaScript code into web pages viewed by users. This issue arises when user-supplied input is improperly handled and reflected directly in the output of a...

CVE-2025-2071

CVE-2025-2071 pertains to the FAST LTA Silent Brick WebUI, where an OS command injection vulnerability exists due to improper handling of untrusted input passed to system-level commands. The flaw affects WebUI input handling for parameters such as “hd” and “pi” and could allow remote attackers to...

CVE-2025-2071 OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

CVE-2025-2071: Improper Neutralization of Special Elements used in an OS Command

A critical OS Command Injection vulnerability has been identified in the FAST LTA Silent Brick WebUI, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This vulnerability arises due to improper handling of untrusted input, which is passed direct...

PT-2025-13672 · Unknown · Fast Lta Silent Brick Webui

Name of the Vulnerable Software and Affected Versions: FAST LTA Silent Brick WebUI versions prior to 2.63.04 Description: A critical OS Command Injection issue has been identified, allowing remote attackers to execute arbitrary operating system commands via specially crafted input. This issue...

FAST LTA Silent Brick WebUI 安全漏洞

The FAST LTA Silent Brick WebUI is a web-based user interface for a Silent Brick data storage system from FAST LTA. A security vulnerability exists in FAST LTA Silent Brick WebUI versions prior to 2.63, which stems from reflective cross-site scripting and could allow an attacker to inject malicio...