Lollms Webui
Approved changes feed: RSS · Atom
cpe:2.3:a:lollms:lollms-webui:9.0:*:*:*:*:*:*:*
part: a version: 9.0 update: *
| Vendor | Lollms (c462c41a-51fb-579f-8ef2-5b37366b074d) |
|---|---|
| Product | Lollms Webui (b2a1cced-948c-5799-bcda-7edd409fa278) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parisneo/lollms-webui |
purl2cpe | 2026-06-01 10:17:49.450942 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-1601 |
vulnerable | 2026-06-08 06:27:13.718231 |
SQL Injection in parisneo/lollms-webui
HIGH (7.5)
An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the `/delete_discussion` endpoint, which internally calls the vulnerable `delete_discussion()` function. By sending a specially crafted payload in the 'id' parameter, an attacker can manipulate SQL queries to delete all records from the 'discussion' and 'message' tables. This issue is due to improper neutralization of special elements used in an SQL command.
Published: 2024-04-16T00:00:14.318Z
Updated: 2024-08-01T18:48:21.597Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.