2316 matches found
CVE-2024-7990
CVE-2024-7990 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
CVE-2024-7990
...
CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting XSS vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious...
Open WebUI 资源管理错误漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A resource management error vulnerability exists in Open WebUI version v0.3.8, which stems from the use of an overly large name field during registration by an unauthorized user, which may caus...
PT-2025-12200
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A stored cross-site scripting XSS issue exists, allowing an attacker to inject malicious scripts through the /api/v1/models/add endpoint, where the model description field is improperly sanitized...
PT-2025-12180
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A Stored Cross-Site Scripting XSS issue exists in the chat file upload functionality. An attacker can inject malicious content into a file, which, when accessed by a victim through a URL or share...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version 0.3.8, which stems from an improperly handled file path in the downloadmodel endpoint, which could lead to arbitrary file writes...
PT-2025-12175
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The issue allows an attacker to perform Cross-Site Request Forgery CSRF attacks. This can happen when an unaware user visits a malicious site or through top-level navigation, causing them to...
PT-2025-12179
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The issue allows attackers to view and delete any files due to improper access control. The application fails to verify whether the attacker is an administrator, enabling them to directly call th...
CVE-2024-7983: Allocation of Resources Without Limits or Throttling
In version 0.3.8 of open-webui, an endpoint for converting markdown to HTML is exposed without authentication. A maliciously crafted markdown payload can cause the server to spend excessive time converting it, leading to a denial of service. The server becomes unresponsive to other requests until...
PT-2025-12211
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.10 Description The api/v1/utils/pdf endpoint lacks authentication mechanisms, allowing unauthenticated attackers to access the PDF generation service. This issue can be exploited by sending a POST request wit...
PT-2025-12177
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The application exhibits improper privilege management. An attacker with administrator privileges can delete other administrators by directly accessing the API endpoint...
PT-2025-12183
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A vulnerability allows an attacker with a user-level account to perform a session fixation attack. The session cookie for all users is set with the default SameSite=Lax and does not have the Secu...
PT-2025-12138
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32 Description The absence of authentication mechanisms in open-webui/open-webui allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8 that stems from improper access control and allows an attacker to view and delete arbitrary files...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. A security vulnerability exists in Open WebUI version v10, which stems from improper path cleanup and could lead to unauthorized directory access...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8, which stems from a mismanagement of permissions that allows an administrator to delete other administrators via the API...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.3.8 that stems from improper access control and allows an attacker to view any prompted information...