LW
Product
Lollms Web UI
46
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 18High 18Medium 9Low 1
Watch
Add Lollms Web UI to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-9920 | 8.8 | Mar 20 | Unrestricted File Upload and Execution in parisneo/lollms-webui Affected: 12 |
| CVE-2024-6040 | 8.8 | Aug 1 | In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities Affected: 9.8 |
| CVE-2024-1522 | 8.8 | Mar 30 | A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system Affected: 9.0 through 9.2 |
| CVE-2024-9919 | 8.4 | Mar 20 | Missing Authentication Check in parisneo/lollms-webui Affected: 13 |
| CVE-2024-4897 | 8.4 | Jul 2 | parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version… Affected: before 9.8 |
| CVE-2024-3435 | 8.4 | May 16 | A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5 Affected: before 9.5 |
| CVE-2024-3126 | 8.4 | May 16 | A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script Affected: before 9.5 |
| CVE-2024-2288 | 8.3 | Jun 6 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui… Affected: before 9.3 |
| CVE-2024-4498 | 7.7 | Jun 25 | A Path Traversal and Remote File Inclusion (RFI) vulnerability exists in the parisneo/lollms-webui application, affecting versions v9.7 to the latest Affected: 9.7 |
| CVE-2024-12766 | 7.5 | Mar 20 | SSRF in parisneo/lollms-webui Affected: 13 |
| CVE-2025-1451 | 7.5 | Mar 20 | Insufficient Patch Leading to DoS in parisneo/lollms-webui Affected: 13 |
| CVE-2024-6394 | 7.5 | Sep 30 | A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8 Affected: 9.8 |
| CVE-2024-6250 | 7.5 | Jun 27 | An absolute path traversal vulnerability exists in parisneo/lollms-webui v9.6, specifically in the `open_file` endpoint of `lollms_advanced.py` Affected: 9.6 |
| CVE-2024-2548 | 7.5 | Jun 6 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `lollms_core/lollms/server/endpoints/lollms_binding_files_server.py` and… Affected: before 9.5 |
| CVE-2024-2178 | 7.5 | Jun 2 | A path traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'copy_to_custom_personas' endpoint in the 'lollms_personalities_infos.py' file Affected: before 9.4 |
| CVE-2024-4322 | 7.5 | May 16 | A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint Affected: before 9.8 |
| CVE-2024-6674 | 7.1 | Oct 29 | A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settings containing… Affected: before 10 |
| CVE-2024-6959 | 7.1 | Oct 13 | A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file Affected: 9.8 |
Showing 18