Open WebUI AI-based web interface SSRF

The vulnerability of the processpictureurl function backend/openwebui/utils/oauth.py in the Open WebUI AI-based web interface is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

Open WebUI AI-based web interface get_tool_by_id() Unauthorized Access

The vulnerability of the gettoolbyid function in the Open WebUI AI-based web interface is related to the lack of authorization when processing parameters like toolids and toolservers. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Open WebUI Web Interface XSS

The vulnerability of the Open WebUI web interface is related to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS using a specially created URL address...

TOTOLINK A8000RU: Operating System Command Injection Vulnerability

The TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. The Totolink A8000RU version 7.1cu.643b20200521 suffers from an OS command injection vulnerability that originates from the enable operation of the parameter of the function setRemoteCfg in the Web Management...

PT-2026-42979

A vulnerability was detected in Totolink A8000RU 7.1cu.643 b20200521. Affected by this issue is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. The manipulation of the argument enable results in os command injection. The attack may be...

TOTOLINK A8000RU: Operating System Command Injection Vulnerability

The TOTOLINK A8000RU is a wireless router from China's Gion Electronics TOTOLINK. An OS command injection vulnerability exists in TOTOLINK A8000RU version 7.1cu.643b20200521, which originates from the operation of the function setPasswordCfg on the parameter admpass in the Web Management Interfac...

Open WebUI Unrestricted File Loading

The vulnerability of the Open WebUI web interface is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms and load any desired files...

CVE-2026-9404

A vulnerability was identified in Totolink A8000RU 7.1cu.643b20200521. This affects the function setDdnsCfg of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Such manipulation of the argument provider leads to os command injection. The attack may be launched remotely. Th...

EUVD-2026-31543

A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is...

PT-2026-42956

A security flaw has been discovered in Totolink A8000RU 7.1cu.643 b20200521. The affected element is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi of the component Web Management Interface. Performing a manipulation of the argument resetFlags results in os command injection. It is...

Glances Monitoring Tool Unauthorized Access

The vulnerability of the Glances monitoring tool’s web interface is related to the lack of a mechanism for verifying the source of the data. Exploiting this vulnerability could allow an attacker operating remotely to gain unauthorized access to protected information...

PT-2026-42978

Name of the Vulnerable Software and Affected Versions Totolink A8000RU version 7.1cu.643 b20200521 Description An OS command injection issue exists in the Web Management Interface. This occurs when the firewallType argument is manipulated within the setFirewallType function of the...

CVE-2018-25358

The CVE-2018-25358 entry concerns the D-Link DIR-601 (firmware 2.02NA) where an unauthenticated attacker can disclose credentials via /my_cgi.cgi by manipulating the table_name parameter in POST requests. Affected data includes administrative credentials and wireless keys, exposed in cleartext. T...

PAN-OS Web Interface Arbitrary Command Execution

The vulnerability of the PAN-OS operating system’s web interface is related to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary commands remotely...

Open WebUI Web Interface XSS

The vulnerability in the Open WebUI web interface is related to the lack of protection for the structure of the web page when processing the profileimageurl field. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Open WebUI Authentication Bypass

The vulnerability in the Open WebUI web interface relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

Open WebUI XSS

The vulnerability of the Open WebUI web interface is related to deficiencies in the security measures used to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks using a malicious SVG file...

Open WebUI Authentication Privilege Escalation

The vulnerability of the Open WebUI web interface is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to enhance their privileges and disclose sensitive information...

Open WebUI Authentication Bypass

The vulnerability in the Open WebUI web interface relates to bypassing authentication using a key controlled by the user during the processing of the final endpoint /api/chat/completions. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Open WebUI AI-based web interface _validate_collection_access() Unauthorized Access

The vulnerability of the validatecollectionaccess function in the Open WebUI AI-based web interface relates to bypassing authentication using a user-controlled key. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to protected information...