POC-CVE-2024-6778

CVE-2024-6778 该仓库包含针对 CVE-2024-6778 的概念验证漏洞利用代码，这些是 Chromium 网页浏览器中允许通过浏览器扩展实现沙箱逃逸的漏洞。要运行这些漏洞利用程序，你需要一个版本低于 126.0.6478.54 的 Chromium。 相关文章：https://ading.dev/blog/posts/chromesandboxescape.html 漏洞报告：https://issues.chromium.org/issues/338248595 CVE-2024-6778 目录包含一个概念验证的 Chrome 扩展，可以在特权 WebUI 页面上执行任...

CVE-2023-20273

CVE-2023-20273 CVE-2023-20273 漏洞利用 PoC 用法 root@kitploit: usage: exploit.py -h -t URL -u Username -p Password -c Command | -r -dest Outfile -www | -tcp | -null -ip LocalIP -port LocalPort -fs filesystem -path filepath -operation operationtype -v -q CVE-2023-20273 Exploit PoC options: -h, --help sh...

CVE-2025-64495-POC

CVE-2025-64495-POC Open WebUI 在启用“以富文本方式插入提示”时，存在通过提示触发的存储型 DOM XSS 漏洞，可导致账户接管（ATO）或远程代码执行（RCE） 摘要 当“以富文本方式插入提示”功能启用时，将自定义提示插入聊天窗口的功能容易受到 DOM XSS 攻击，因为提示内容被直接赋值给 DOM sink .innerHtml 而未经过净化。任何拥有创建提示权限的用户都可以利用此漏洞植入载荷，其他用户如果执行对应的 / 命令来插入该提示，就会触发该载荷。 详情 受影响的代码行位于：...

CVE-2026-88738

Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file. The uploaded file is stored in a web-accessible executable location and can be...

CVE-2026-88738

The Jazzware RT1000 Edge webUI v. 20.0.1 is affected by an unrestricted file upload vulnerability within the upgrade package upload functionality. An attacker with administrative privileges can upload a server-side executable file, which is stored in a web-accessible location. This allows for rem...

webui

版权所有 C 2003-2021 Young Consulting, Inc 本程序为自由软件；您可依据自由软件基金会发布的 GNU 通用公共许可证条款（第 2 版或（由您选择）任何后续版本）重新分发和/或修改本程序。 本程序的发布是希望它能够发挥作用，但不提供任何担保；甚至没有隐含的适销性或特定用途适用性保证。详情请参阅 GNU 通用公共许可证。 您应已收到一份 GNU 通用公共许可证的副本；如果没有，请写信至自由软件基金会：59 Temple Place, Suite 330, Boston, MA 02111-1307 USA root@kitploit: Application:...

The vulnerability in the Open WebUI web interface, related to insufficient validation of requests on the server side, allows a hacker to perform an SSRF attack.

The vulnerability of the Open WebUI web interface related to insufficient validation of requests on the server side when processing the AIOHTTPCLIENTALLOWREDIRECTS parameter. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

The vulnerability of the `metaalert_minutes` component in the `backend/open_webui/models/calendar.py` file of the Open WebUI AI-based web interface allows a attacker to compromise the accessibility of protected information.

The vulnerability of the metaalertminutes component in the backend/openwebui/models/calendar.py file of the Open WebUI AI-based web interface is related to incorrect validation of the specified data type. Exploiting this vulnerability could allow an attacker to compromise the accessibility of...

The vulnerability in the backend/open_webui/utils/misc.py file of the Open WebUI artificial intelligence-based web interface allows a attacker to compromise the accessibility of protected information.

The vulnerability in the backend/openwebui/utils/misc.py file of the Open WebUI artificial intelligence-based web interface is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to compromise the accessibility of...

The vulnerabilities in the backend files open_webui/routers/auths.py, backend/open_webui/utils/oauth.py, and backend/open_webui/socket/main.py of the Open WebUI artificial intelligence-based web interface allow a attacker to compromise the confidentiality and integrity of the protected information.

The vulnerability in the web interface based on artificial intelligence, namely backend/openwebui/routers/auths.py, backend/openwebui/utils/oauth.py, and backend/openwebui/socket/main.py, is related to incorrect session expiration times. Exploiting this vulnerability could allow a malicious actor...

CVE-2026-33340

CVE-2026-33340: SSRF en lollms-webui Descripción general Campo| Detalle ---|--- ID CVE| CVE-2026-33340 Vulnerabilidad| Falsificación de solicitudes del lado del servidor Server-Side Request Forgery, SSRF Producto afectado| ParisNeo/lollms-webui LoLLMS WEBUI Gravedad| Crítica — CVSS 9.1 Vector CVS...

CVE-2026-70481

CVE-2026-70481 Open WebUI 受影响版本为 0.5.0 至 0.10.2，已在 0.11.0 中修复。中危，CVSS 5.4，CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L，CWE-284 和 CWE-862。 在 backend/openwebui/routers/channels.py 中，消息更新和删除处理程序根据频道类型进行分支，而这两个分支提出的问题不同。群组和私信频道仅限作者本人操作。 root@kitploit: if channel.type in 'group', 'dm': if not await...

POC_CVE-2024-4322

CVE-2024-4322：LoLLMS WebUI PoC 与 Nuclei 验证实验室 本仓库提供 Docker 化的本地实验室，用于复现 CVE-2024-4322 （LoLLMS WebUI v9.6 中的一个路径遍历漏洞），并验证相关的 Nuclei 模板不会匹配 LoLLMS WebUI v9.8。 请仅对本地、自有或明确授权的目标使用此实验室。 漏洞摘要 LoLLMS WebUI v9.6 中的 /listpersonalities 端点存在路径遍历漏洞。用户可控的 category 参数未经净化处理即被追加到 personalitieszoopath：...

POC_CVE-2024-12537

CVE-2024-12537 Open WebUI コードフォーマット DoS ラボ このリポジトリには、CVE-2024-12537（Open WebUI のコードフォーマットエンドポイントにおける認証不要のサービス拒否脆弱性）のローカルでの独立した再現ラボと nuclei テンプレート案が含まれています。 ラボは大規模なサービス拒否ペイロードを送信しません。認証不要の /api/version フィンガープリントエンドポイントと、"code":"x" の最小限のリクエストを /api/v1/utils/code/format に送信することで nuclei...

CVE-2026-91735

An incorrect authorization flaw was found in the WebUI component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=552416113...

DEBIAN-CVE-2026-91735

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91735

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91735

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-79972

Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-91735

CVE-2026-91735 is an incorrect authorization flaw in the WebUI component of Google Chrome (Chromium) prior to 153.0.8010.47 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to execute arbitrary code outside the sandbox , rated High by Chromiu...