Lollms Webui
Approved changes feed: RSS · Atom
cpe:2.3:a:lollms:lollms-webui:9.1:*:*:*:*:*:*:*
part: a version: 9.1 update: *
| Vendor | Lollms (c462c41a-51fb-579f-8ef2-5b37366b074d) |
|---|---|
| Product | Lollms Webui (b2a1cced-948c-5799-bcda-7edd409fa278) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parisneo/lollms-webui |
purl2cpe | 2026-06-01 10:17:49.451839 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-1601 |
vulnerable | 2026-06-08 06:27:13.718418 |
SQL Injection in parisneo/lollms-webui
HIGH (7.5)
An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the `/delete_discussion` endpoint, which internally calls the vulnerable `delete_discussion()` function. By sending a specially crafted payload in the 'id' parameter, an attacker can manipulate SQL queries to delete all records from the 'discussion' and 'message' tables. This issue is due to improper neutralization of special elements used in an SQL command.
Published: 2024-04-16T00:00:14.318Z
Updated: 2024-08-01T18:48:21.597Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-1569 |
vulnerable | 2026-06-08 06:27:13.466753 |
Uncontrolled Resource Consumption in parisneo/lollms-webui
MEDIUM (5.3)
parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.
Published: 2024-04-16T00:00:14.761Z
Updated: 2024-08-01T18:40:21.481Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.