PT-2026-104620

A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get environment of the file goldenverba/components/util.py of the component generate stream Endpoint. The manipulation leads to information disclosure. It is possible to initiate the attac...

CVE-2025-57203

MagicProject AI version 9.1 is affected by a Cross-Site Scripting XSS vulnerability within the chatbot generation feature available to authenticated admin users. The vulnerability resides in the prompt parameter submitted to the /dashboard/user/generator/generate-stream endpoint via a...

LiquidThemes MagicAI 安全漏洞

LiquidThemes MagicAI is an AI software from LiquidThemes, UK. A security vulnerability exists in LiquidThemes MagicAI version 9.1, which stems from insufficient cleanup of the prompt parameter input in the dashboard/user/generator/generate-stream endpoint, which could lead to a cross-site scripti...

PT-2025-39066

Name of the Vulnerable Software and Affected Versions MagicProject AI version 9.1 Description MagicProject AI version 9.1 is affected by a Cross-Site Scripting XSS issue within the chatbot generation feature accessible to authenticated admin users. The issue is located in the prompt parameter...

CVE-2025-57203

MagicProject AI (version 9.1) is vulnerable to a Cross-Site Scripting (XSS) flaw within the chatbot generation feature. The root cause is insufficient input sanitization of the prompt parameter submitted via a multipart/form-data POST request to the /dashboard/user/generator/generate-stream endpo...

PT-2025-12274

Name of the Vulnerable Software and Affected Versions haotian-liu/llava version v1.2.0 Description A Server-Side Request Forgery SSRF issue exists in the "POST /worker generate stream" API endpoint of the Controller API Server. This allows attackers to exploit the server's credentials, performing...

Server-side Request Forgery (SSRF)

Overview fastchat is a fastchat with guidance support Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the workergeneratestream API endpoint. An attacker can exploit the victim controller API server's credentials to perform unauthorized web actions or...

CVE-2024-10044

A Server-Side Request Forgery SSRF vulnerability exists in the POST /workergeneratestream API endpoint of the Controller API Server in lm-sys/fastchat, as of commit e208d5677c6837d590b81cb03847c0b9de100765. This vulnerability allows attackers to exploit the victim controller API server's...

FastChat 代码问题漏洞

FastChat is LMSYS Org's is an open platform for training, deploying, and evaluating chatbots based on large language models. A code issue vulnerability exists in FastChat that stems from a server-side request forgery vulnerability in the POST/workergeneratestream API endpoint that allows an...