Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

9 records

Vendor: Lollms Component: Lollms-webui Clear all filters
TI-2024-04761 CVE-2024-5125 · GHSA-8p2m-96j6-h5p5

XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui

Priority HIGH 67

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process.

CVSS 3.1HIGH 7.3 Local No auth User interaction EPSS 0.00315 Published 2024-11-14 Fixed in 9.8 CWE-79
TI-2024-06470 CVE-2024-6971 · GHSA-7pgr-32fx-c6x9

Path Traversal in parisneo/lollms-webui

Priority MEDIUM 54

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file.

CVSS 3.1MEDIUM 4.4 Local High privileges No interaction EPSS 0.00319 Published 2024-10-11 No fix listed CWE-22
TI-2024-04503 CVE-2024-4839 · GHSA-v2f9-5493-gg7h

CSRF in Servers Configurations in parisneo/lollms-webui

Priority MEDIUM 49

A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the parisneo/lollms-webui, versions 9.6 to the latest.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00163 Published 2024-06-24 No fix listed CWE-352
TI-2024-04505 CVE-2024-4841 · GHSA-p4vx-w5q8-cq9j

Path Traversal in parisneo/lollms-webui

Priority MEDIUM 49

A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization.

CVSS 3.1LOW 3.3 Local Low privileges No interaction EPSS 0.00668 Published 2024-06-23 No fix listed CWE-29
TI-2024-04100 CVE-2024-4403 · GHSA-8xp7-8ggj-xfq4

CSRF in restart_program in parisneo/lollms-webui

Priority HIGH 71

A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00166 Published 2024-06-10 No fix listed CWE-352
TI-2024-03972 CVE-2024-4267 · GHSA-98jh-mf4r-8hc8

Remote Code Execution in parisneo/lollms-webui

Priority HIGH 76

A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01484 Published 2024-05-22 No fix listed CWE-77
TI-2024-01465 CVE-2024-1569 · GHSA-g2mr-jcjh-hmc7

Uncontrolled Resource Consumption in parisneo/lollms-webui

Priority LOW 34

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00782 Published 2024-04-16 Fixed in 9.2 CWE-400
TI-2024-01494 CVE-2024-1601 · GHSA-v84m-cf86-322v

SQL Injection in parisneo/lollms-webui

Priority HIGH 81

An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.40416 Published 2024-04-16 Fixed in 9.2 CWE-89
TI-2024-01529 CVE-2024-1646 · GHSA-5wh4-2859-9f36

Authentication Bypass in parisneo/lollms-webui

Priority HIGH 75

parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints.

CVSS 3.0HIGH 8.2 Network No auth No interaction EPSS 0.00701 Published 2024-04-16 Fixed in 9.3 CWE-288