3377 matches found
CVE-2024-8581 Path Traversal in parisneo/lollms-webui
A vulnerability in the uploadapp function of parisneo/lollms-webui V12 Strawberry allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the filename value, causing a Path Traversal error...
CVE-2024-8581
CVE-2024-8581 concerns parisneo/lollms-webui, version V12 (Strawberry). The vulnerability is in the upload_app function where unsanitized filename input enables Path Traversal, allowing an attacker to delete arbitrary files or directories on the host. Root cause: lack of user input filtering for ...
CVE-2024-8581 Path Traversal in parisneo/lollms-webui
A vulnerability in the uploadapp function of parisneo/lollms-webui V12 Strawberry allows an attacker to delete any file or directory on the system. The function does not implement user input filtering with the filename value, causing a Path Traversal error...
CVE-2024-12537
...
CVE-2024-12537 Unauthenticated Denial of Service in open-webui/open-webui
In version 0.3.32 of open-webui/open-webui, the absence of authentication mechanisms allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request with an excessively high volume of content, the server could become completely...
CVE-2024-9840
CVE-2024-9840 is a duplicate of CVE-2024-53981 (per the initial description). Connected data confirms CVE-2024-53981 describes a vulnerability in python-multipart (a streaming multipart parser) with a DoS risk when parsing form data; fixed in version 0.0.18. There is no separate active entry for ...
CVE-2024-7959
The Open WebUI SSRF issue is in open-webui/open-webui version 0.3.8, exposed via the /openai/models endpoint. The vulnerable component allows changing the OpenAI URL without validation, causing the server to issue requests to arbitrary destinations and return their output. Reported impact include...
CVE-2024-7959 SSRF in open-webui/open-webui
The /openai/models endpoint in open-webui/open-webui version 0.3.8 is vulnerable to Server-Side Request Forgery SSRF. An attacker can change the OpenAI URL to any URL without checks, causing the endpoint to send a request to the specified URL and return the output. This vulnerability allows the...
CVE-2024-7990
CVE-2024-7990 is rejected/not used; this CVE ID does not represent an active vulnerability entry.
CVE-2024-7990 Stored Cross-Site Scripting in open-webui/open-webui
A stored cross-site scripting XSS vulnerability exists in open-webui/open-webui version 0.3.8. The vulnerability is present in the /api/v1/models/add endpoint, where the model description field is improperly sanitized before being rendered in chat. This allows an attacker to inject malicious...
CVE-2024-12374 Stored XSS in automatic1111/stable-diffusion-webui
A stored cross-site scripting XSS vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript...
PT-2025-12200
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description A stored cross-site scripting XSS issue exists, allowing an attacker to inject malicious scripts through the /api/v1/models/add endpoint, where the model description field is improperly sanitized...
PT-2025-12138
Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.32 Description The absence of authentication mechanisms in open-webui/open-webui allows any unauthenticated attacker to access the api/v1/utils/code/format endpoint. If a malicious actor sends a POST request...