CVE-2024-11824 Stored XSS in langgenius/dify

A stored cross-site scripting XSS vulnerability exists in langgenius/dify version latest, specifically in the chat log functionality. The vulnerability arises because certain HTML tags like and are not disallowed, allowing an attacker to inject malicious HTML into the log via prompts. When an adm...

CVE-2024-8251

CVE-2024-8251 affects mintplex-labs/anything-llm prior to version 1.2.2. The vulnerability resides in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is passed directly to the Prisma where clause, enabling Prisma injection. An attacker can supply crafted JSON such as {"ses...

CVE-2024-8251 Prisma Injection in mintplex-labs/anything-llm

A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint "/embed/:embedId/stream-chat" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a special...

CVE-2024-11441 Stored XSS in Serge in serge-chat/serge

A stored cross-site scripting XSS vulnerability exists in Serge version 0.9.0. The vulnerability is due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this vulnerability by sending a crafted message containing malicious HTML/JavaScript...

CVE-2024-11441 Stored XSS in Serge in serge-chat/serge

A stored cross-site scripting XSS vulnerability exists in Serge version 0.9.0. The vulnerability is due to improper neutralization of input during web page generation in the chat prompt. An attacker can exploit this vulnerability by sending a crafted message containing malicious HTML/JavaScript...

ChuanhuChatGPT 安全漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. ChuanhuChatGPT suffers from a security bypass vulnerability that originates when a username is provided via a client-side HTTP request, which...

AnythingLLM 安全漏洞

AnythingLLM is an all-in-one AI application open-sourced by Mintplex. A security vulnerability exists in version 6dc3642 of AnythingLLM, which stems from an unauthenticated denial of service in the API embedded in the chat functionality, which allows an attacker to cause the server to crash by...

NetEase QAnything 跨站脚本漏洞

NetEase QAnything is a local knowledge base question and answer system from China's NetEase, Inc. that is designed to support files or databases in any format, and can be installed and used offline. A cross-site scripting vulnerability exists in NetEase QAnything. An attacker can exploit this...

Open WebUI 跨站脚本漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in Open WebUI version 0.3.8, which stems from the presence of stored cross-site scripting in the chat file upload function, which could lead to user...

LibreChat 访问控制错误漏洞

LibreChat is an enhanced ChatGPT clone. LibreChat suffers from an Improper Access Control vulnerability that can be exploited by an attacker to corrupt application logic and permissions and allow unauthorized operations...

anything-llm 输入验证错误漏洞

anything-llm is an all-in-one desktop and Docker AI application open-sourced by Mintplex. An input validation error vulnerability exists in versions prior to anything-llm 1.2.2, which stems from the presence of Prisma injection in the API endpoint /embed/:embedId/stream-chat, which allows an...

Open WebUI 访问控制错误漏洞

Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. An Access Control Error vulnerability exists in Open WebUI version v0.3.8, which stems from improper access control that allows an administrator to view the chat logs of other administrators...

PT-2025-12178 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: The issue is related to improper access control. Administrators are supposed to view only the chats of non-admin members on the frontend admin page. However, it is possible to view the chats o...

ChuanhuChatGPT 访问控制错误漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An access control error vulnerability exists in ChuanhuChatGPT version 20240802, which stems from improper handling of session data and lack ...

chuanhuchatgpt 跨站脚本漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An HTML injection vulnerability exists in chuanhuchatgpt version 20b2e02, which stems from improper HTML tag cleanup in chat history uploads,...

Leaked Black Basta Chats Suggest Russian Officials Aided Leader's Escape from Armenia

The recently leaked trove of internal chat logs among members of the Black Basta ransomware operation has revealed possible connections between the e-crime gang and Russian authorities. The leak, containing over 200,000 messages from September 2023 to September 2024, was published by a Telegram...

Analysis of Black Basta Ransomware Chat Leaks

Analysis of Black Basta Ransomware Chat Leaks By Jambul Tologonov and John Fokker · March 18, 2025 Introduction On Feb 11, 2025 a Telegram user @ExploitWhispers shared via their Telegram channel ‘shopotbasta’ EN: ‘basta whisper’ Black Basta RaaS Ransomware as a Service Matrix chat leaks containin...

CVE-2025-2334

A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access...

CVE-2025-2334

A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access...

CVE-2025-2334

A vulnerability classified as problematic has been found in 274056675 springboot-openai-chatgpt e84f6f5. This affects the function deleteChat of the file /api/mjkj-chat/chat/ai/delete/chat of the component Chat History Handler. The manipulation of the argument chatListId leads to improper access...