9984 matches found
appsec-forge
appsec-forge Erstellt für Entwickler, DevOps, AppSec, DevSecOps und Sicherheitsingenieure. Eine repository-zentrierte Wissensdatenbank für Sicherheit, die sichere Entwicklung, Anwendungssicherheit, Infrastruktur, Software-Lieferkette, KI und DevSecOps abdeckt. Studiere Sicherheitsprobleme so, wie...
EUVD-2026-67815
Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chatid/history, DELETE /chat/chatid, and POST /chat/chatid/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...
CVE-2026-28187
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
CVE-2026-28187
The CVE-2026-28187 issue affects the WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin, version
CVE-2026-28187
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
EUVD-2026-57965
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
CVE-2026-28187 WordPress Knowledge Base for Documentation, FAQs with AI Assistance plugin <= 17.211.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
PT-2026-71531
Unauthenticated Cross Site Scripting XSS in Knowledge Base for Documentation, FAQs with AI Assistance = 17.211.0 versions...
sqlicat
sqlicat Framework de SQL Injection em Python puro stdlib...
CVE-2026-70488
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...
GHSA-JXC9-XMC4-GR23 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Summary A user with write access to one knowledge base could delete directories, and drop file embeddings, belonging to knowledge bases they do not control. The sync cleanup endpoint verified write access on the knowledge base named in the URL and then acted on the directory and file ids supplied...
CVE-2026-70488
CVE-2026-70488 – Open WebUI : In Open WebUI builds from 0.9.6 to 0.11.0, the sync cleanup endpoint (POST /api/v1/knowledge/{id}/sync/cleanup) did not properly constrain actions to the target knowledge base. The handler authenticated write access via the URL knowledge base, then acted on directory...
CVE-2026-70488 Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, the sync cleanup endpoint authorized write access to the knowledge base in the URL but then acted on directory and file ids supplied in the request body without checking that those objec...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
EUVD-2026-51934
The AI ChatBot for WooCommerce WordPress plugin before 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions, allowing unauthenticated users to abuse the site owner's stored third-party API key to send requests billed to the owner's account and, when an optional featu...
CVE-2026-15241
The CVE-2026-15241 affects the AI ChatBot for WooCommerce WordPress plugin prior to 4.8.4. It lacks authorization/nonce checks on an AJAX action, enabling unauthenticated users to abuse the site owner’s stored third‑party API key to send requests billed to the owner and, if enabled, retrieve inde...
