CVE-2024-12374

A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...

CVE-2024-12374

CVE-2024-12374 : Stored XSS in automatic1111/stable-diffusion-webui (git 82a973c). An attacker can upload an HTML file that the app treats as content-type application/html; when a victim visits the malicious link, arbitrary JavaScript runs in the browser. Connected documents confirm the vulnerabi...

PT-2025-12095

Name of the Vulnerable Software and Affected Versions invoke-ai/invokeai version v5.0.2 Description A Denial of Service DoS issue was discovered in the "/api/v1/boards/board id" endpoint. This occurs when an excessively large payload is sent in the board name field during a PATCH request, causing...

LoLLMs Web UI security vulnerabilities

LoLLMs Web UI is a web user interface for large languages and multimodal systems by Saifeddine ALOUI Individual Developer. A security vulnerability exists in LoLLMs Web UI version V13, which originates from an unauthenticated URL and could lead to a server-side request forgery attack...

LoLLMs Web UI security vulnerabilities

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from the startappserver function not properly cleaning up the appname parameter, which could lea...

PT-2025-12181

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version v0.3.8 Description The issue is related to improper access control, allowing an attacker to view any prompts without verifying if the attacker is an administrator. This enables the attacker to directly call the...

PT-2025-11683

A cross-site scripting XSS vulnerability has been discovered in the Additional TCA extension. This vulnerabily is exploitable by a logged in backend user utilizing the TYPO3 backend user interface. This user can create output in the HTML context by exploiting improperly encoded user input. Update...

PT-2025-11682

Name of the Vulnerable Software and Affected Versions Clickstorm SEO extension for TYPO3 versions prior to 6.7.0 Clickstorm SEO extension for TYPO3 versions prior to 7.4.0 Clickstorm SEO extension for TYPO3 versions prior to 8.3.0 Clickstorm SEO extension for TYPO3 versions prior to 9.2.0...

[SECURITY] Fedora 42 Update: podman-tui-1.4.0-1.fc42

podman-tui is a terminal user interface for Podman v4 and v5. podman-tui is using podman.socket service to communicate with podman environm ent and SSH to connect to remote podman machines...

CVE-2024-56338

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

Google Chrome UI Replacement

The vulnerability of Google Chrome relates to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to replace the user interface with a specially created HTML page...

Google Chrome UI Replacement

The vulnerability of Google Chrome relates to errors in information representation by the user interface. Exploiting this vulnerability allows a malicious actor to replace the user interface with a specially created HTML page...

TP-Link TL-SG108E Clickjacking

The vulnerability of TP-Link TL-SG108E router’s microprogramming software is related to errors in information representation by the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...

Mozilla Firefox Information Representation

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird, Thunderbird ESR, are related to information representation errors in the user interface. Exploiting these vulnerabilities can allow an attacker to influence the integrity of protected information...

Microsoft Edge Information Disclosure

The vulnerability of Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow a remote attacker to perform spear-phishing attacks...

Google Chrome User Interface Replacement

The vulnerability of Google Chrome’s user interface is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability allows a malicious actor to replace the user interface with a specially created HTML page...

CVE-2025-25567

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function. NOTE: the Supplier disputes this because the behavior only enables a local user to attack himself through the UI,...

EPAS-UI Authentication Bypass

The vulnerability of the HMI SCADA system of the electric power automation system, EcoStruxure Power Automation System User Interface EPAS-UI, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow attackers to compromise the confidentiality, integrity,...

CVE-2024-56338

IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2024-45328

An incorrect authorization vulnerability CWE-863 in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute elevated CLI commands via the GUI console menu...