Lollms

Records68All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical25CVSS 9.0–10.0

CVSS high25CVSS 7.0–8.9

Exploited now

Lollms records in CISA KEV

No Lollms vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Lollms Web Ui 46 records HIGH Lollms 12 records HIGH Lollms-webui 9 records HIGH Lord Of Large Language Models 1 record HIGH

Records

9 records in Lollms-webui · all components

TI-2024-01494 CVE-2024-1601 · GHSA-v84m-cf86-322v

SQL Injection in parisneo/lollms-webui

HIGH 81

An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.40416 Published 2024-04-16 Fixed in 9.2 CWE-89

TI-2024-03972 CVE-2024-4267 · GHSA-98jh-mf4r-8hc8

Remote Code Execution in parisneo/lollms-webui

HIGH 76

A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01484 Published 2024-05-22 No fix listed CWE-77

TI-2024-01529 CVE-2024-1646 · GHSA-5wh4-2859-9f36

Authentication Bypass in parisneo/lollms-webui

HIGH 75

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints.

CVSS 3.0HIGH 8.2 Network No auth No interaction EPSS 0.00701 Published 2024-04-16 Fixed in 9.3 CWE-288

TI-2024-04100 CVE-2024-4403 · GHSA-8xp7-8ggj-xfq4

CSRF in restart_program in parisneo/lollms-webui

HIGH 71

A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00166 Published 2024-06-10 No fix listed CWE-352

TI-2024-04761 CVE-2024-5125 · GHSA-8p2m-96j6-h5p5

XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui

HIGH 67

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process.

CVSS 3.1HIGH 7.3 Local No auth User interaction EPSS 0.00315 Published 2024-11-14 Fixed in 9.8 CWE-79

TI-2024-06470 CVE-2024-6971 · GHSA-7pgr-32fx-c6x9

Path Traversal in parisneo/lollms-webui

MEDIUM 54

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file.

CVSS 3.1MEDIUM 4.4 Local High privileges No interaction EPSS 0.00319 Published 2024-10-11 No fix listed CWE-22

TI-2024-04505 CVE-2024-4841 · GHSA-p4vx-w5q8-cq9j

Path Traversal in parisneo/lollms-webui

MEDIUM 49

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00668 Published 2024-06-23 No fix listed CWE-29

TI-2024-04503 CVE-2024-4839 · GHSA-v2f9-5493-gg7h

CSRF in Servers Configurations in parisneo/lollms-webui

MEDIUM 49

A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00163 Published 2024-06-24 No fix listed CWE-352

TI-2024-01465 CVE-2024-1569 · GHSA-g2mr-jcjh-hmc7

Uncontrolled Resource Consumption in parisneo/lollms-webui

LOW 34

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00782 Published 2024-04-16 Fixed in 9.2 CWE-400

Open these records in search →