COPG

🎮 COPG Самый продвинутый спуфер устройства и процессора для Android — обходите ограничения и открывайте премиум-графику, повышенный FPS и эксклюзивные функции в большинстве игр и приложений. ✨ Почему COPG? COPG — это модуль Zygisk , который заставляет большинство игр и приложений думать, что они...

LoLLMS WebUI - Subfolder Prediction via Path Traversal

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'addreferencetolocalmode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. id: CVE-2024-4841 info: name: LoLLMS WebUI - Subfolder Prediction via Path...

LoLLMS WebUI < 9.8 - Path Traversal

parisneo/lollms-webui contains a path traversal caused by improper handling of 'category' parameter in /listpersonalities endpoint, letting attackers list arbitrary directories, exploit requires control over 'category' parameter. id: CVE-2024-4322 info: name: LoLLMS WebUI 9.8 - Path Traversal...

LoLLMs WEBUI - Server-Side Request Forgery

LoLLMs WEBUI contains a server-side request forgery caused by unauthenticated access to the /api/proxy endpoint, letting attackers force the server to make arbitrary GET requests, exploit requires no authentication. id: CVE-2026-33340 info: name: LoLLMs WEBUI - Server-Side Request Forgery author:...

Hermes WebUI < 0.51.788 - Remote Code Execution

Hermes WebUI 0.51.788 contains an unauthenticated remote code execution caused by improper access control in embedded terminal API endpoints, letting remote attackers execute arbitrary shell commands without credentials. id: CVE-2026-58123 info: name: Hermes WebUI 0.51.788 - Remote Code Execution...

Open WebUI 'LDAP Empty Password' - Authentication Bypass

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.0, the LDAP authentication endpoint does not validate that the submitted password is non-empty before performing a Simple Bind against the LDAP server. The LdapForm Pydantic model accep...

Open WebUI < 0.9.5 - Information Disclosure

Open WebUI 0.9.5 contains an information disclosure vulnerability caused by unauthenticated access to GET /api/v1/retrieval/ endpoint, letting remote attackers retrieve live RAG pipeline configuration without authorization, exploit requires no authentication. id: CVE-2026-45397 info: name: Open...

Stable Diffusion Webui 1.10.0 - Open Redirect

An open redirect vulnerability exists in Stable-Diffusion-Webui 1.10.0, where the file parameter in the /file= endpoint can be manipulated to redirect users to malicious websites. This could facilitate phishing attacks by tricking users into visiting attacker-controlled URLs. id: CVE-2024-11044...

Aria2 WebUI - Path traversal

webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability. id: CVE-2023-39141 info: name: Aria2 WebUI - Path traversal author: DhiyaneshDk severity: high description: | webui-aria2 commit 4fe2e was discovered to contain a path traversal vulnerability. impact: | An attacker...

LOLLMS WebUI - Absolute Path Traversal

An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the openfile endpoint of lollmsadvanced.py. The sanitizepath function with allowabsolutepath=True allows an attacker to access arbitrary files and directories on a Windows system. This vulnerability can...

Loytec LGATE-902 <6.4.2 - Local File Inclusion

Loytec LGATE-902 versions prior to 6.4.2 suffers from a local file inclusion vulnerability. id: CVE-2018-14916 info: name: Loytec LGATE-902 6.4.2 - Local File Inclusion author: 0xAkoko severity: critical description: Loytec LGATE-902 versions prior to 6.4.2 suffers from a local file inclusion...

CVE-2024-7808

CVE-2024-7808 💀 $$\colorred ЭТОТ \space ЭКСПЛОЙТ \space МОЖЕТ \space НАРУШАТЬ \space ЗАКОН.$$ $$\colorred\space ВЫ \space НЕСЁТЕ \space ОТВЕТСТВЕННОСТЬ \space ЗА \space СВОИ \space ДЕЙСТВИЯ.$$ $$\colorredТОЛЬКО \space ДЛЯ \space ДЕМОНСТРАЦИИ.$$ ОПИСАНИЕ Удаленное выполнение кода неадминистраторам...

CVE-2023-20198-Scanner

Cisco IOS XE Device Scanner — руководство пользователя для CVE-2023-20198-Scanner Это сканер для снятия отпечатков веб-шеллов, предназначенный для обнаружения имплантов в Cisco IOS XE WebUI, затронутых CVE-2023-20198 и CVE-2023-20273. Этот Python-скрипт проверяет скомпрометированные устройства...

CVE-2023-20198-RCE

Fofa root@kitploit: body="window.onload=function url ='/webui';window.location.href=url;" && ishoneypot=false && isfraud=false Использование root@kitploit: usage: CVE-2023-20198-RCE.py -h -u URL -p PROXY -au ADDUSER -ap ADDPASS -du DELUSER -pm PRIVILEGEMODE -em EXPLOITMODE -oc OSCMD -cc CLICMD...

webui

Авторские права C 2003-2021 Young Consulting, Inc Эта программа является свободным программным обеспечением; вы можете распространять и/или изменять её в соответствии с условиями Стандартной общественной лицензии GNU, опубликованной Фондом свободного программного обеспечения; либо версии 2...

CVE-2024-6778-POC

CVE-2024-5836 / CVE-2024-6778 Этот репозиторий содержит эксплойты доказательства концепции для CVE-2024-5836 и CVE-2024-6778, которые являются уязвимостями в веб-браузере Chromium, позволявшими совершить побег из песочницы из расширения браузера. Для запуска этих эксплойтов необходимо использоват...

CVE-2023-20198

CVE-2023-20198 Un script d'exploitation développé pour exploiter la vulnérabilité zero day CVE-2023-20198 de Cisco sur leur IOS XE Les pirates exploitent largement cette vulnérabilité qui crée un utilisateur de niveau 15 en contournant l'authentification. Un contenu XML malveillant permet...

The vulnerability in the Open WebUI web interface, related to insufficient validation of requests on the server side, allows a hacker to perform an SSRF attack.

The vulnerability of the Open WebUI web interface related to insufficient validation of requests on the server side when processing the AIOHTTPCLIENTALLOWREDIRECTS parameter. Exploiting this vulnerability allows a remote attacker to perform an SSRF attack...

The vulnerability of the `metaalert_minutes` component in the `backend/open_webui/models/calendar.py` file of the Open WebUI AI-based web interface allows a attacker to compromise the accessibility of protected information.

The vulnerability of the metaalertminutes component in the backend/openwebui/models/calendar.py file of the Open WebUI AI-based web interface is related to incorrect validation of the specified data type. Exploiting this vulnerability could allow an attacker to compromise the accessibility of...

The vulnerability in the backend/open_webui/utils/misc.py file of the Open WebUI artificial intelligence-based web interface allows a attacker to compromise the accessibility of protected information.

The vulnerability in the backend/openwebui/utils/misc.py file of the Open WebUI artificial intelligence-based web interface is related to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow a malicious actor to compromise the accessibility of...