26192 matches found
CVE-2025-62364 text-generation-webui allows arbitrary file read via symbolic link upload
text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...
CVE-2025-62364
The CVE-2025-62364 issue affects text-generation-webui (up to version 3.13). A Local File Inclusion exists in the character picture upload feature: an attacker can upload a text file containing a symbolic link to an arbitrary file path, and when processed the app follows the link and serves the t...
CVE-2025-62364 text-generation-webui allows arbitrary file read via symbolic link upload
text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...
CVE-2025-62364 text-generation-webui allows arbitrary file read via symbolic link upload
text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...
CVE-2025-62364: Improper Link Resolution Before File Access
text-generation-webui is an open-source web interface for running Large Language Models. In versions through 3.13, a Local File Inclusion vulnerability exists in the character picture upload feature. An attacker can upload a text file containing a symbolic link to an arbitrary file path. When the...
Text Generation Web UI 后置链接漏洞
Text Generation Web UI is a UI interface for native AI by oobabooga individual developers. A backlink vulnerability exists in Text Generation Web UI version 3.13 and earlier, which stems from a local file inclusion vulnerability in the character image upload feature that could result in reading...
PT-2025-41812
Name of the Vulnerable Software and Affected Versions text-generation-webui versions through 3.13 Description text-generation-webui is a web interface for running Large Language Models. A Local File Inclusion issue exists in the character picture upload feature. An attacker can upload a text file...
CVE-2025-9550
The Drupal Facets module is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of user-provided text during web page generation. This flaw allows an attacker to inject malicious scripts into web pages. The vulnerability affects versions 0.0.0 through 2.0.10 and 3.0.0 through ...
CVE-2025-55321
Improper neutralization of input during web page generation 'cross-site scripting' in Azure Monitor allows an authorized attacker to perform spoofing over a network...
CVE-2017-20202
Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to...
CVE-2025-60002
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Template Definitions page that, when visited by another user, enables the attacker to execute commands with the...
CVE-2025-25018
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting XSS...
EUVD-2025-33705
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting XSS...
CVE-2025-25017 Kibana Stored Cross-Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting XSS...
CVE-2025-25017
Kibana vulnerability CVE-2025-25017 is a stored XSS in the Vega visualization engine due to improper input validation in Vega visualization specifications. Likely affects Kibana dashboards; potential impacts include session hijacking and data theft. No exploitation details or official patch versi...
CVE-2025-25017 Kibana Stored Cross-Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to Cross-Site Scripting XSS...
EUVD-2025-33707
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting XSS...
CVE-2025-25018 Kibana Stored Cross-Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation in Kibana can lead to stored Cross-Site Scripting XSS...
