4343 matches found
CVE-2025-43846
Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. Versions 2.2.231006 and prior are vulnerable to unsafe deserialization. The ckptpath1 variable takes user input e.g. a path to a model and passes it to the showinfo function in processckpt.py, which uses it to loa...
Retrieval-based-Voice-Conversion-WebUI 代码问题漏洞
Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A code issue vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from improper handling of the ckptpath0 variable, and could lead to unsaf...
Retrieval-based-Voice-Conversion-WebUI 代码注入漏洞
Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A code injection vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from improper handling of the ckptpath2 variable and could lead to...
PT-2025-19749 · Unknown · Retrieval-Based-Voice-Conversion-Webui
Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The ckpt path1 variable takes user input, such as a path to a model, and...
Retrieval-based-Voice-Conversion-WebUI 代码问题漏洞
Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A code issue vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from improper handling of the modelchoose variable, and could lead to...
PT-2025-19787
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. A vulnerability in the way certain html tags in chat messages are rendered allows attackers to...
Retrieval-based-Voice-Conversion-WebUI 代码问题漏洞
Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A code issue vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from improper handling of the modelchoose variable, and could lead to...
PT-2025-19772
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.6.6 Description Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Low-privileged users can upload HTML files containing JavaScript code via the "/api/v1/files/"...
Retrieval-based-Voice-Conversion-WebUI 命令注入漏洞
Retrieval-based-Voice-Conversion-WebUI is an open source voice training modeling tool from RVC-Project. A command injection vulnerability exists in Retrieval-based-Voice-Conversion-WebUI version 2.2.231006 and earlier, which stems from command injection...
PT-2025-19738 · Unknown · Retrieval-Based-Voice-Conversion-Webui
Name of the Vulnerable Software and Affected Versions: Retrieval-based-Voice-Conversion-WebUI versions 2.2.231006 and prior Description: Retrieval-based-Voice-Conversion-WebUI is a voice changing framework based on VITS. The variables exp dir1, np7, trainset dir4, and sr2 take user input and pass...
Open WebUI 跨站脚本漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.6, which stems from a low-privileged user being able to upload HTML files containing JavaScript code, which...
Open WebUI 跨站脚本漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A cross-site scripting vulnerability exists in versions of Open WebUI prior to 0.6.6 that stems from improper rendering of HTML tags in chat messages, which could lead to cross-site scripting...
CVE-2025-29446
open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verifyconnection...
Server-side Request Forgery (SSRF)
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the verifyconnection function, by manipulating the backend requests to arbitrary systems. Remediation Upgrade open-webui to version 0.6.34 or higher. References - GitH...
CVE-2025-29446
Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...
CVE-2025-29446
open-webui v0.5.16 is vulnerable to SSRF in routers/ollama.py in function verifyconnection...
PT-2025-17455 · Unknown · Open-Webui
Name of the Vulnerable Software and Affected Versions: open-webui version 0.5.16 Description: The issue concerns a Server-Side Request Forgery SSRF vulnerability. It is located in the routers/ollama.py file, specifically in the verify connection function. Recommendations: For open-webui version...
CVE-2025-29446
CVE-2025-29446 is associated with Open WebUI 0.5.16, where the SSRF vulnerability resides in routers/ollama.py, function verify_connection. Red Hat’s advisory and Snyk report confirm a Server-Side Request Forgery vulnerability affecting this version and advise upgrading to Open WebUI >= 0.6.34...
Open WebUI 安全漏洞
Open WebUI is an extensible, feature-rich, user-friendly self-hosted WebUI from Open WebUI open source. A security vulnerability exists in Open WebUI version v0.5.16, which stems from the vulnerability of the verifyconnection function in routers/ollama.py to a server-side request forgery attack...