Lollms Webui
Approved changes feed: RSS · Atom
cpe:2.3:a:parisneo:lollms-webui:9.8:*:*:*:*:*:*:*
part: a version: 9.8 update: *
| Vendor | Parisneo (47ba7f99-dd62-5638-afc5-b468bbe8b724) |
|---|---|
| Product | Lollms Webui (afd02487-6cc3-515e-b49e-0301e1326e89) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parisneo/lollms-webui |
purl2cpe | 2026-06-01 10:16:47.625913 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-6959 |
vulnerable | 2026-06-08 06:58:20.836798 |
Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui
HIGH (7.1)
A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file. If an attacker appends a large number of characters to the end of a multipart boundary, the system will continuously process each character, rendering lollms-webui inaccessible. This issue is exacerbated by the lack of Cross-Site Request Forgery (CSRF) protection, enabling remote exploitation. The vulnerability leads to service disruption, resource exhaustion, and extended downtime.
Published: 2024-10-13T12:28:19.491Z
Updated: 2024-11-03T18:27:25.639Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-6040 |
vulnerable | 2026-06-08 06:58:17.277989 |
Missing client_id in parisneo/lollms-webui
MEDIUM (4.4)
In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities. Specifically, the endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are susceptible to CSRF attacks and local attacks. An attacker can exploit this vulnerability to perform unauthorized actions on the victim's machine.
Published: 2024-08-01T15:32:43.624Z
Updated: 2025-10-15T12:50:32.126Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.