# ParisNeo lollms-webui. Every CVE that names ParisNeo lollms-webui among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first - [LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint](https://agentprime.io/advisories/CVE-2026-33340.md) `CVE-2026-33340` · CVE record: ParisNeo lollms-webui · CVSS 9.1 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.22 · Not analysed yet · Published 24 Mar 2026 · Tags: Authentication bypass, Server-side request forgery (SSRF) - [Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2356.md) `CVE-2024-2356` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Feb 2026 · Tags: CWE-29 - [SSRF in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-12766.md) `CVE-2024-12766` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: Server-side request forgery (SSRF) - [Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-8736.md) `CVE-2024-8736` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.1 High · Not analysed yet · Published 20 Mar 2025 · Tags: Cross-site request forgery (CSRF) - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-8898.md) `CVE-2024-8898` · CVE record: parisneo parisneo/lollms-webui · CVSS 6.7 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal - [Insufficient Patch Leading to DoS in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2025-1451.md) `CVE-2025-1451` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Not analysed yet · Published 20 Mar 2025 · Tags: Denial of service - [Cross-site Scripting (XSS) in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6986.md) `CVE-2024-6986` · CVE record: parisneo parisneo/lollms-webui · CVSS 5.5 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Cross-site scripting (XSS) - [Path Traversal and OS Command Injection in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-10019.md) `CVE-2024-10019` · CVE record: parisneo parisneo/lollms-webui · CVSS 6.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Command injection - [Unrestricted File Upload and Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-9920.md) `CVE-2024-9920` · CVE record: parisneo parisneo/lollms-webui · CVSS 6.6 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Unrestricted file upload - [Missing Authentication Check in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-9919.md) `CVE-2024-9919` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 20 Mar 2025 · Tags: Authentication bypass - [Directory Listing Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-10047.md) `CVE-2024-10047` · CVE record: parisneo parisneo/lollms-webui · CVSS 5.3 Medium · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-8581.md) `CVE-2024-8581` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Mar 2025 · Tags: Path traversal - [XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-5125.md) `CVE-2024-5125` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.3 High · Not analysed yet · Published 14 Nov 2024 · Tags: Cross-site scripting (XSS) - [CSRF Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6673.md) `CVE-2024-6673` · CVE record: parisneo parisneo/lollms-webui · CVSS 4.4 Medium · Not analysed yet · Published 29 Oct 2024 · Tags: Cross-site request forgery (CSRF) - [Data Leak through CORS Misconfiguration in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6674.md) `CVE-2024-6674` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2024 · Tags: CWE-346 - [Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6959.md) `CVE-2024-6959` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2024 · Tags: Cross-site request forgery (CSRF) - [Local File Inclusion in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6394.md) `CVE-2024-6394` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2024 · Tags: CWE-29 - [Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4897.md) `CVE-2024-4897` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 2 Jul 2024 · Tags: CWE-76 - [Cross-site Scripting (XSS) in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-5933.md) `CVE-2024-5933` · CVE record: parisneo parisneo/lollms-webui · CVSS 6.1 Medium · Not analysed yet · Published 27 Jun 2024 · Tags: Cross-site scripting (XSS) - [Absolute Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-6250.md) `CVE-2024-6250` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Not analysed yet · Published 27 Jun 2024 · Tags: Path traversal - [Path Traversal and RFI Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4498.md) `CVE-2024-4498` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.7 High · Not analysed yet · Published 25 Jun 2024 · Tags: Path traversal - [CSRF in Servers Configurations in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4839.md) `CVE-2024-4839` · CVE record: parisneo parisneo/lollms-webui · CVSS 4.4 Medium · Not analysed yet · Published 24 Jun 2024 · Tags: Cross-site request forgery (CSRF) - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4841.md) `CVE-2024-4841` · CVE record: parisneo parisneo/lollms-webui · CVSS 4.0 Medium · Not analysed yet · Published 23 Jun 2024 · Tags: CWE-29 - [CSRF in restart_program in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4403.md) `CVE-2024-4403` · CVE record: parisneo parisneo/lollms-webui · CVSS 4.4 Medium · Not analysed yet · Published 10 Jun 2024 · Tags: Cross-site request forgery (CSRF) - [CSRF in clear_personality_files_list in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4328.md) `CVE-2024-4328` · CVE record: parisneo parisneo/lollms-webui · CVSS 4.0 Medium · Not analysed yet · Published 10 Jun 2024 · Tags: Cross-site request forgery (CSRF) - [Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2359.md) `CVE-2024-2359` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: Command injection - [Path Traversal leading to Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2360.md) `CVE-2024-2360` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-29 - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-3322.md) `CVE-2024-3322` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 6 Jun 2024 · Tags: Path traversal - [Path Traversal and Denial of Service in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1873.md) `CVE-2024-1873` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.13 · Not analysed yet · Published 6 Jun 2024 · Tags: Path traversal - [CSRF File Upload Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2288.md) `CVE-2024-2288` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.3 High · Not analysed yet · Published 6 Jun 2024 · Tags: Cross-site request forgery (CSRF) - [Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4320.md) `CVE-2024-4320` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.34 · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-29 - [Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2624.md) `CVE-2024-2624` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: CWE-29 - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2548.md) `CVE-2024-2548` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Not analysed yet · Published 6 Jun 2024 · Tags: Path traversal - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2362.md) `CVE-2024-2362` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jun 2024 · Tags: Path traversal - [SSRF in add_webpage endpoint in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-5482.md) `CVE-2024-5482` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.4 High · Not analysed yet · Published 6 Jun 2024 · Tags: Server-side request forgery (SSRF) - [Path Traversal Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2178.md) `CVE-2024-2178` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Not analysed yet · Published 2 Jun 2024 · Tags: CWE-29 - [Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4267.md) `CVE-2024-4267` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 22 May 2024 · Tags: Command injection - [Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2361.md) `CVE-2024-2361` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2024 · Tags: CWE-29 - [Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2366.md) `CVE-2024-2366` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2024 · Tags: Command injection - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-3435.md) `CVE-2024-3435` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 16 May 2024 · Tags: CWE-29 - [Command Injection in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-3126.md) `CVE-2024-3126` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.4 High · Not analysed yet · Published 16 May 2024 · Tags: Command injection - [Remote Code Execution via \`/apply_settings\` and \`/execute_code\` in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4326.md) `CVE-2024-4326` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2024 · Tags: CWE-15 - [Path Traversal in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-4322.md) `CVE-2024-4322` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.31 · Not analysed yet · Published 16 May 2024 · Tags: CWE-29 - [Path Traversal leading to Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2358.md) `CVE-2024-2358` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 May 2024 · Tags: CWE-29 - [Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-2299.md) `CVE-2024-2299` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.4 High · Not analysed yet · Published 12 May 2024 · Tags: Cross-site scripting (XSS) - [Uncontrolled Resource Consumption in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1569.md) `CVE-2024-1569` · CVE record: parisneo parisneo/lollms-webui · CVSS 5.3 Medium · Not analysed yet · Published 16 Apr 2024 · Tags: Denial of service - [SQL Injection in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1601.md) `CVE-2024-1601` · CVE record: parisneo parisneo/lollms-webui · CVSS 7.5 High · Critical (CVSS 7+ and EPSS) · EPSS 0.40 · Not analysed yet · Published 16 Apr 2024 · Tags: SQL injection - [Authentication Bypass in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1646.md) `CVE-2024-1646` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.2 High · Not analysed yet · Published 16 Apr 2024 · Tags: Authentication bypass - [Stored XSS leading to RCE in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1602.md) `CVE-2024-1602` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.8 High · Not analysed yet · Published 10 Apr 2024 · Tags: Cross-site scripting (XSS) - [OS Command Injection in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1520.md) `CVE-2024-1520` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.48 · Not analysed yet · Published 10 Apr 2024 · Tags: Command injection - [Path Traversal Vulnerability in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1511.md) `CVE-2024-1511` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 10 Apr 2024 · Tags: Path traversal - [Local File Inclusion in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1600.md) `CVE-2024-1600` · CVE record: parisneo parisneo/lollms-webui · CVSS 9.3 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.33 · Not analysed yet · Published 10 Apr 2024 · Tags: File inclusion - [Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui](https://agentprime.io/advisories/CVE-2024-1522.md) `CVE-2024-1522` · CVE record: parisneo parisneo/lollms-webui · CVSS 8.8 High · Not analysed yet · Published 30 Mar 2024 · Tags: Cross-site request forgery (CSRF) ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .