363 matches found
CVE-2025-59397
Open Web Analytics OWA before 1.8.1 allows owadb.php vvalue SQL injection...
GHSA-PC6W-59FV-RH23 vulnerabilities
Vulnerabilities for packages: open-webui...
CVE-2025-6984 vulnerabilities
Vulnerabilities for packages: open-webui...
pentest-guide
This repository is an offensive tool for penetration testing, specifically a guide based on OWASP Open Web Application Security Project including test cases, resources, and examples. It contains various modules and tools for testing different types of vulnerabilities, such as Brute Force, Busines...
Adoption Agency Data Exposure Revealed Information About Children and Parents
A trove of 1.1 million records left accessible on the open web shows how much sensitive information can be created—and made vulnerable—during the adoption process...
CVE-2022-24637
Open Web Analytics OWA before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '...
WordPress Free Shipping Bar: Amount Left for Free Shipping for WooCommerce plugin <= 2.4.6 - Cross Site Scripting (XSS) Vulnerability
Cross Site Scripting XSS Vulnerability discovered by muhammad yudha in WordPress Plugin Free Shipping Bar: Amount Left for Free Shipping for WooCommerce versions = 2.4.6...
WordPress EduMall Theme <= 4.2.4 is vulnerable to Local File Inclusion
Software EduMall Type Theme Vulnerable versions = 4.2.4 Fixed in 4.3.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2025-2101 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID ce27fee25f49 Credits Tonn Required privilege Unauthenticated Published ...
GHSA-JRHC-9QG9-4QFQ Open WebUI Allows Arbitrary File Reading and Deletion
An improper access control vulnerability in open-webui/open-webui v0.3.8 allows attackers to view and delete any files. The application does not verify whether the attacker is an administrator, allowing the attacker to directly call the GET /api/v1/files/ interface to retrieve information on all...
编号撤回
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI Open Source. This CVE number has been withdrawn...
Cross-site Scripting (XSS)
Overview open-web-calendar is an Embed a highly customizable web calendar into your website using ICal source links Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing validations in URL protocols and unsanitized error messages, leading to data theft or...
CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...
PT-2024-38040
Name of the Vulnerable Software and Affected Versions open-webui version 0.3.8 Description An information disclosure issue exists related to the embedding model update feature under admin settings. When a user updates the model path, the system checks if the file exists and provides different err...
acc-collision.com Cross Site Scripting vulnerability OBB-3901327
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
PT-2026-39282
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.1.124 Description An issue exists in the self-hosted artificial intelligence platform where the application fails to validate or sanitize the filename during file uploads. When attaching files to a prompt via the...
[SECURITY] Fedora 40 Update: BareBonesBrowserLaunch-3.1-33.fc40
Utility class to open a web page from a Swing application in the user's default browser. Supports: Mac OS X, GNU/Linux, Unix, Windows XP...
Jenkins OWASP Dependency-Check Plugin Security Vulnerability
Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...
longashtongolfclub.co.uk Cross Site Scripting vulnerability OBB-3738237
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
sticker-ribbon.com Cross Site Scripting vulnerability OBB-3657718
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
