LoLLMs (Lord of Large Language Multimodal Systems) Web UI 9.0
Approved changes feed: RSS · Atom
cpe:2.3:a:lollms:lollms_web_ui:9.0:*:*:*:*:*:*:*
part: a version: 9.0 update: *
| Vendor | Lollms (c462c41a-51fb-579f-8ef2-5b37366b074d) |
|---|---|
| Product | Lollms Web Ui (0b1ee2ff-111a-5b86-a28c-8ca2d46629c4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parisneo/lollms-webui |
purl2cpe | 2026-06-01 10:17:49.459081 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-1602 |
vulnerable | 2026-06-08 06:27:13.728263 |
Stored XSS leading to RCE in parisneo/lollms-webui
HIGH (8.8)
parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting (XSS) that leads to Remote Code Execution (RCE). The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within the user's browser context, enabling the attacker to send a request to the `/execute_code` endpoint and establish a reverse shell to the attacker's host. The issue affects various components of the application, including the handling of user input and model output.
Published: 2024-04-10T17:08:02.423Z
Updated: 2024-08-01T18:48:21.887Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1511 |
vulnerable | 2026-06-08 06:25:40.311823 |
Path Traversal Vulnerability in parisneo/lollms-webui
CRITICAL (9.8)
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files on the server by exploiting various endpoints. The vulnerability can be exploited even when the service is bound to localhost, through cross-site requests facilitated by malicious HTML/JS pages.
Published: 2024-04-10T17:08:01.043Z
Updated: 2024-08-01T18:40:21.305Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.