LW
Product
Lollms Web UI
46
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 18Medium 9Low 1
Watch
Add Lollms Web UI to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-8898 | 9.8 | Mar 20 | Path Traversal in parisneo/lollms-webui Affected: 12 |
| CVE-2024-4320 | 9.8 | Jun 6 | A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the… Affected: All versions, or not specified |
| CVE-2024-3322 | 9.8 | Jun 6 | A path traversal vulnerability exists in the 'cyber_security/codeguard' native personality of the parisneo/lollms-webui, affecting versions up to 9.5 Affected: before 9.5 |
| CVE-2024-2624 | 9.8 | Jun 6 | A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the `@router.get("/switch_personal_path")` endpoint… Affected: before 9.4 |
| CVE-2024-2360 | 9.8 | Jun 6 | parisneo/lollms-webui is vulnerable to path traversal attacks that can lead to remote code execution due to insufficient sanitization of user-supplied input in the 'Database path'… Affected: All versions, or not specified |
| CVE-2024-2359 | 9.8 | Jun 6 | A vulnerability in the parisneo/lollms-webui version 9.3 allows attackers to bypass intended access restrictions and execute arbitrary code Affected: 9.3 |
| CVE-2024-5482 | 9.8 | Jun 6 | A Server-Side Request Forgery (SSRF) vulnerability exists in the 'add_webpage' endpoint of the parisneo/lollms-webui application, affecting the latest version Affected: All versions, or not specified |
| CVE-2024-4326 | 9.8 | May 16 | A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code Affected: before 9.5 |
| CVE-2024-2358 | 9.8 | May 16 | A path traversal vulnerability in the '/apply_settings' endpoint of parisneo/lollms-webui allows attackers to execute arbitrary code Affected: before 9.5 |
| CVE-2024-1520 | 9.8 | Apr 10 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the… Affected: 9.0 before 9.2 |
| CVE-2024-1511 | 9.8 | Apr 10 | The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths Affected: 9.0 |
| CVE-2024-2361 | 9.6 | May 16 | A vulnerability in the parisneo/lollms-webui allows for arbitrary file upload and read due to insufficient sanitization of user-supplied input Affected: before 9.5 |
| CVE-2024-1600 | 9.3 | Apr 10 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route Affected: 9.0 before 9.6 |
| CVE-2026-33340 | 9.1 | Mar 24 | LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint Affected: All versions, or not specified |
| CVE-2024-8581 | 9.1 | Mar 20 | Path Traversal in parisneo/lollms-webui Affected: 12 |
| CVE-2024-2362 | 9.1 | Jun 6 | A path traversal vulnerability exists in the parisneo/lollms-webui version 9.3 on the Windows platform Affected: 9.3 |
| CVE-2024-1873 | 9.1 | Jun 6 | parisneo/lollms-webui is vulnerable to path traversal and denial of service attacks due to an exposed `/select_database` endpoint in version a9d16b0 Affected: All versions, or not specified |
| CVE-2024-2366 | 9.0 | May 16 | A remote code execution vulnerability exists in the parisneo/lollms-webui application, specifically within the reinstall_binding functionality in… Affected: before 9.5 |
Showing 18