CVE-2024-11169 Unhandled Exception Leading to Server Crash in danny-avila/librechat

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash...

CVE-2024-11169

CVE-2024-11169 concerns an unhandled exception in danny-avila/librechat (commit 3c94ff2) triggered during file upload handling via the fs module, allowing an unauthenticated user to crash the server. The issue is fixed in version 0.7.6. Remediation: upgrade LibreChat to 0.7.6 or later. The docume...

CVE-2024-11169

An unhandled exception in danny-avila/librechat version 3c94ff2 can lead to a server crash. The issue occurs when the fs module throws an exception while handling file uploads. An unauthenticated user can trigger this exception by sending a specially crafted request, causing the server to crash...

CVE-2024-10513 Path Traversal in mintplex-labs/anything-llm

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the...

CVE-2024-10513

CVE-2024-10513 describes a path traversal in mintplex-labs/anything-llm prior to 1.2.2 via the /api/document/move-files endpoint in the document uploads manager. An attacker with the manager role can relocate the anythingllm.db database to a publicly accessible directory, then download and delete...

CVE-2024-10513 Path Traversal in mintplex-labs/anything-llm

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the...

CVE-2024-10513

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the...

CVE-2024-10513 Path Traversal in mintplex-labs/anything-llm

A path traversal vulnerability exists in the 'document uploads manager' feature of mintplex-labs/anything-llm, affecting the latest version prior to 1.2.2. This vulnerability allows users with the 'manager' role to access and manipulate the 'anythingllm.db' database file. By exploiting the...

CVE-2024-10481 Cross-Site Request Forgery (CSRF) in comfyanonymous/comfyui

A CSRF vulnerability exists in comfyanonymous/comfyui versions up to v0.2.2. This vulnerability allows attackers to host malicious websites that, when visited by authenticated ComfyUI users, can perform arbitrary API requests on behalf of the user. This can be exploited to perform actions such as...

CVE-2025-1385

When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a library from a specified path and execute it in an isolated process. Combined with the ClickHouse table engine functionality that permits...

Cross-site Scripting (XSS)

modx/revolution is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper file validation due to authenticated users being able to upload SVG files containing malicious JavaScript, which executes in victims' browsers when viewing the profile image...

LLAVA Cross-Site Request Forgery Vulnerability

LLaVA is an application by the individual developer Haotian Liu. A cross-site request forgery vulnerability exists in LLaVA v1.2.0, which stems from cross-site request forgery and could allow an attacker to upload malicious files and execute arbitrary JavaScript code...

PT-2025-12321

Name of the Vulnerable Software and Affected Versions parisneo/lollms-webui version v13 Description A vulnerability arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate the length of the boundary or the characters appended to it, allowin...

PT-2025-12210

Name of the Vulnerable Software and Affected Versions danswer-ai/danswer version 0.3.94 Description A Denial of Service DoS issue allows an attacker to cause the application to become inaccessible by uploading a file with a malformed multipart boundary. This is achieved by appending a large numbe...

FastChat resource management error vulnerability

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large language models. A resource management error vulnerability exists in FastChat version 0.2.36, which stems from improper handling of large filenames in the file upload feature and could lead to a...

PT-2025-12023

Name of the Vulnerable Software and Affected Versions Realchar version v0.0.4 Description The issue is an unauthenticated denial of service DoS attack that exists in the file upload request handling. By appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request,...

RealChar resource management error vulnerability

RealChar is a tool by shaun personal developer that allows you to create, customize and talk to AI characters/companions in real time. A resource management error vulnerability exists in RealChar version v0.0.4, which stems from mishandling of file upload requests and could lead to an...

GPT Academic Cross-Site Request Forgery Vulnerability

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site request forgery vulnerability that stems from a WEB application that does not adequately verify that a request is from a trusted user. An attacke...

Gradio security vulnerabilities

Gradio, an open source Python library from Gradio Open Source, is a method for demonstrating machine learning models through a friendly web interface. A security vulnerability exists in Gradio that stems from the failure to properly handle multi-part boundaries during file uploads, which could le...

ChuanhuchatGPT Cross-Site Scripting Vulnerability

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An HTML injection vulnerability exists in chuanhuchatgpt version 20b2e02, which stems from improper HTML tag cleanup in chat history uploads,...