363 matches found
OWASP CRS 安全漏洞
OWASP CRS is an open source attack detection rule set from the CRS Project. A security vulnerability exists in OWASP CRS versions prior to 4.22.0 and prior to 3.3.8, which stems from a flaw in rule 922110 when processing multipart requests, which could lead to malicious character sets being ignor...
CVE-2025-66019 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
CVE-2025-68480 vulnerabilities
Vulnerabilities for packages: ggshield, open-webui, airflow...
GHSA-428G-F7CQ-PGP5 vulnerabilities
Vulnerabilities for packages: open-webui, superset, airflow-core, py3-marshmallow, ggshield, airflow...
CVE-2025-63391
An authentication bypass vulnerability exists in Open-WebUI =0.6.32 in the /api/config endpoint. The endpoint lacks proper authentication and authorization controls, exposing sensitive system configuration data to unauthenticated remote attackers...
CVE-2025-63391
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-63391
...
Exploit for CVE-2023-12345
Exploit-DB MCP Server for Pentesting A Model Context Protocol...
CVE-2025-66416 vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: semgrep, open-webui...
GHSA-9H52-P55H-VW2F vulnerabilities
Vulnerabilities for packages: open-webui, semgrep...
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Summary A Stored XSS vulnerability has been discovered in Open-WebUI's Notes PDF download functionality. An attacker can import a Markdown file containing malicious SVG tags into Notes, allowing them to execute arbitrary JavaScript code and steal session tokens when a victim downloads the note as...
open-webui is Vulnerable to Incorrect Access Control
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers a normal user to stop arbitrary LLM response tasks...
EUVD-2025-38253
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Versions 0.6.224 and prior contain a code injection vulnerability in the Direct Connections feature that allows malicious external model servers to execute arbitrary JavaScript in victim browsers vi...
GHSA-2QFP-Q593-8484 vulnerabilities
Vulnerabilities for packages: mitmproxy...
GHSA-2QFP-Q593-8484 vulnerabilities
Vulnerabilities for packages: superset, pgadmin4, mitmproxy, nemo...
GHSA-7F5H-V6XP-FCQ8 vulnerabilities
Vulnerabilities for packages: airflow, reflex, kserve, mlflow, open-webui, k8s-sidecar...