CVE-2025-9544: Undefined Security Weakness

The Doppler Forms WordPress plugin through 2.5.1 registers an AJAX action installextension without verifying user capabilities or using a nonce. As a result, any authenticated user — including those with the Subscriber role — can install and activate additional Doppler Forms WordPress plugin...

CVE-2024-4320

A remote code execution RCE vulnerability exists in the '/installextension' endpoint of the parisneo/lollms-webui application, specifically within the @router.post"/installextension" route handler. The vulnerability arises due to improper handling of the name parameter in the...

CVE-2024-4320

CVE-2024-4320 describes a remote code execution via path traversal in parisneo/lollms (extensions builder). The Red Hat and related records credit a vulnerability in parisneo/lollms where ExtensionBuilder().build_extension() on the /mount_extension endpoint (and similarly described install_extens...

CVE-2024-4320: Path Traversal: '\..\filename'

A remote code execution RCE vulnerability exists in the '/installextension' endpoint of the parisneo/lollms-webui application, specifically within the @router.post"/installextension" route handler. The vulnerability arises due to improper handling of the name parameter in the...