Lunary 资源管理错误漏洞

Lunary is Lunary open source a production toolkit for LLM . A security vulnerability exists in Lunary version 105a3f6 that originates from allowing users to upload and execute arbitrary regular expressions, which can be exploited by an attacker to potentially cause a regular expression denial of...

PT-2025-12023

Name of the Vulnerable Software and Affected Versions Realchar version v0.0.4 Description The issue is an unauthenticated denial of service DoS attack that exists in the file upload request handling. By appending characters, such as dashes -, to the end of a multipart boundary in an HTTP request,...

RealChar 资源管理错误漏洞

RealChar is a tool by shaun personal developer that allows you to create, customize and talk to AI characters/companions in real time. A resource management error vulnerability exists in RealChar version v0.0.4, which stems from mishandling of file upload requests and could lead to an...

PT-2025-12102

Name of the Vulnerable Software and Affected Versions danny-avila/librechat versions prior to 0.7.6 Description The issue is related to improper input validation, specifically with the handling of multipart file uploads using multer middleware. When in-memory storage is used, there is no limit on...

LLaVA 跨站请求伪造漏洞

LLaVA is an application by the individual developer Haotian Liu. A cross-site request forgery vulnerability exists in LLaVA v1.2.0, which stems from cross-site request forgery and could allow an attacker to upload malicious files and execute arbitrary JavaScript code...

ChuanhuChatGPT 输入验证错误漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. A file inclusion vulnerability exists in ChuanhuChatGPT version d4ec6a3, which stems from the gr.JSON component not effectively filtering cal...

FastChat 资源管理错误漏洞

FastChat is an open platform from LMSYS for training, deploying and evaluating chatbots based on large language models. A resource management error vulnerability exists in FastChat version 0.2.36, which stems from improper handling of large filenames in the file upload feature and could lead to a...

Gradio 安全漏洞

Gradio, an open source Python library from Gradio Open Source, is a method for demonstrating machine learning models through a friendly web interface. A security vulnerability exists in Gradio that stems from the failure to properly handle multi-part boundaries during file uploads, which could le...

dify 代码问题漏洞

dify is an open source LLM application development platform from LangGenius Open Source. A code issue vulnerability exists in version 0.10.2 of dify, which stems from the Create Knowledge section when uploading DOCX files is vulnerable to server-side request forgery attacks...

GPT Academic 跨站请求伪造漏洞

GPT Academic is an interface that provides pragmatic interactions for LLM grand language models such as GPT/GLM. GPT Academic suffers from a cross-site request forgery vulnerability that stems from a WEB application that does not adequately verify that a request is from a trusted user. An attacke...

PrivateGPT 跨站脚本漏洞

PrivateGPT is an AI project open-sourced by Zylon. A cross-site scripting vulnerability exists in PrivateGPT version v0.5.0, which stems from cross-site scripting during file uploads, which allows an attacker to upload a malicious SVG file and execute JavaScript when the victim clicks on the file...

chuanhuchatgpt 跨站脚本漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. An HTML injection vulnerability exists in chuanhuchatgpt version 20b2e02, which stems from improper HTML tag cleanup in chat history uploads,...

LLaVA 安全漏洞

LLaVA is an application by the individual developer Haotian Liu. A security vulnerability exists in LLaVA v1.2.0, which stems from improper handling of form-data in a file upload request and could lead to a denial of service attack...

ChuanhuChatGPT 资源管理错误漏洞

ChuanhuChatGPT is an application that provides a lightweight and easy-to-use web GUI and many additional features for a wide range of LLMs such as ChatGPT. A resource management error vulnerability exists in ChuanhuChatGPT version 20240914, which stems from improper handling of large file names i...

FlatPress 跨站脚本漏洞

FlatPress is a lightweight, easy-to-setup flat file blogging engine from the FlatPress open source. A cross-site scripting vulnerability exists in FlatPress, which stems from a JavaScript payload masquerading as a filename in the file upload function, which could lead to a cross-site scripting...

CVE-2025-2512

The CVE-2025-2512 entry concerns the WordPress File Away plugin (versions up to 3.9.9.0.1). The vulnerability is an unauthenticated arbitrary file upload due to a missing capability check and missing file-type validation in upload(), which could enable remote code execution on affected sites. Mul...

CVE-2025-2512 File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function

The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload function in all versions up to, and including, 3.9.9.0.1. This makes it possible for unauthenticated attackers to upload arbitrary files on t...

WordPress plugin File Away 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...

CVE-2025-29401

CVE-2025-29401 is an arbitrary file upload vulnerability affecting emlog pro v2.5.7 in the /views/plugin.php component. The issue allows an attacker to upload a crafted PHP file and achieve remote code execution (RCE). The CVSS 3.1 vector indicates network access, no privileges required, no user ...

PT-2025-11678

Name of the Vulnerable Software and Affected Versions File Away plugin for WordPress versions up to, and including, 3.9.9.0.1 Description The File Away plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check and missing file type validation in the upload...