Advisories · Technology

ParisNeo lollms-webui.

Every CVE that names ParisNeo lollms-webui among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-33340 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
- ParisNeo lollms-webui
- Authentication bypass
- Server-side request forgery (SSRF)
Not analysed yet 24 Mar 2026
CVE-2024-2356 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Remote Code Execution due to LFI in '/reinstall_extension' in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 2 Feb 2026
CVE-2024-12766 CVE record

CVSS 7.5 High

SSRF in parisneo/lollms-webui
- parisneo/lollms-webui
- Server-side request forgery (SSRF)
Not analysed yet 20 Mar 2025
CVE-2024-8736 CVE record

CVSS 7.1 High

Denial of Service (DoS) via Multipart Boundary in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 20 Mar 2025
CVE-2024-8898 CVE record

CVSS 6.7 Medium

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 20 Mar 2025
CVE-2025-1451 CVE record

CVSS 7.5 High

Insufficient Patch Leading to DoS in parisneo/lollms-webui
- parisneo/lollms-webui
- Denial of service
Not analysed yet 20 Mar 2025
CVE-2024-6986 CVE record

CVSS 5.5 Medium

Cross-site Scripting (XSS) in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site scripting (XSS)
Not analysed yet 20 Mar 2025
CVE-2024-10019 CVE record

CVSS 6.3 Medium

Path Traversal and OS Command Injection in parisneo/lollms-webui
- parisneo/lollms-webui
- Command injection
Not analysed yet 20 Mar 2025
CVE-2024-9920 CVE record

CVSS 6.6 Medium

Unrestricted File Upload and Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- Unrestricted file upload
Not analysed yet 20 Mar 2025
CVE-2024-9919 CVE record

CVSS 8.4 High

Missing Authentication Check in parisneo/lollms-webui
- parisneo/lollms-webui
- Authentication bypass
Not analysed yet 20 Mar 2025
CVE-2024-10047 CVE record

CVSS 5.3 Medium

Directory Listing Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 20 Mar 2025
CVE-2024-8581 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 20 Mar 2025
CVE-2024-5125 CVE record

CVSS 7.3 High

XSS and Open Redirect via SVG File Upload in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site scripting (XSS)
Not analysed yet 14 Nov 2024
CVE-2024-6673 CVE record

CVSS 4.4 Medium

CSRF Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 29 Oct 2024
CVE-2024-6674 CVE record

CVSS 8.1 High

Data Leak through CORS Misconfiguration in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-346
Not analysed yet 29 Oct 2024
CVE-2024-6959 CVE record

CVSS 7.1 High

Denial of Service (DOS) in multipart boundary while uploading file in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 13 Oct 2024
CVE-2024-6394 CVE record

CVSS 7.5 High

Local File Inclusion in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 30 Sept 2024
CVE-2024-4897 CVE record

CVSS 8.4 High

Remote Code Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-76
Not analysed yet 2 Jul 2024
CVE-2024-5933 CVE record

CVSS 6.1 Medium

Cross-site Scripting (XSS) in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site scripting (XSS)
Not analysed yet 27 Jun 2024
CVE-2024-6250 CVE record

CVSS 7.5 High

Absolute Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 27 Jun 2024
CVE-2024-4498 CVE record

CVSS 7.7 High

Path Traversal and RFI Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 25 Jun 2024
CVE-2024-4839 CVE record

CVSS 4.4 Medium

CSRF in Servers Configurations in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 24 Jun 2024
CVE-2024-4841 CVE record

CVSS 4.0 Medium

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 23 Jun 2024
CVE-2024-4403 CVE record

CVSS 4.4 Medium

CSRF in restart_program in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2024
CVE-2024-4328 CVE record

CVSS 4.0 Medium

CSRF in clear_personality_files_list in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 10 Jun 2024
CVE-2024-2359 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
- parisneo/lollms-webui
- Command injection
Not analysed yet 6 Jun 2024
CVE-2024-2360 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 6 Jun 2024
CVE-2024-3322 CVE record

CVSS 8.4 High

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2024-1873 CVE record

CVSS 8.2 HighCritical · CVSS 7+ and EPSS

Path Traversal and Denial of Service in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2024-2288 CVE record

CVSS 8.3 High

CSRF File Upload Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 6 Jun 2024
CVE-2024-4320 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 6 Jun 2024
CVE-2024-2624 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 6 Jun 2024
CVE-2024-2548 CVE record

CVSS 7.5 High

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2024-2362 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 6 Jun 2024
CVE-2024-5482 CVE record

CVSS 7.4 High

SSRF in add_webpage endpoint in parisneo/lollms-webui
- parisneo/lollms-webui
- Server-side request forgery (SSRF)
Not analysed yet 6 Jun 2024
CVE-2024-2178 CVE record

CVSS 7.5 High

Path Traversal Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 2 Jun 2024
CVE-2024-4267 CVE record

CVSS 8.4 High

Remote Code Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- Command injection
Not analysed yet 22 May 2024
CVE-2024-2361 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 16 May 2024
CVE-2024-2366 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Remote Code Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- Command injection
Not analysed yet 16 May 2024
CVE-2024-3435 CVE record

CVSS 8.4 High

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 16 May 2024
CVE-2024-3126 CVE record

CVSS 8.4 High

Command Injection in parisneo/lollms-webui
- parisneo/lollms-webui
- Command injection
Not analysed yet 16 May 2024
CVE-2024-4326 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-15
Not analysed yet 16 May 2024
CVE-2024-4322 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

Path Traversal in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 16 May 2024
CVE-2024-2358 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- CWE-29
Not analysed yet 16 May 2024
CVE-2024-2299 CVE record

CVSS 7.4 High

Stored Cross-Site Scripting (XSS) via Profile Picture Upload in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site scripting (XSS)
Not analysed yet 12 May 2024
CVE-2024-1569 CVE record

CVSS 5.3 Medium

Uncontrolled Resource Consumption in parisneo/lollms-webui
- parisneo/lollms-webui
- Denial of service
Not analysed yet 16 Apr 2024
CVE-2024-1601 CVE record

CVSS 7.5 HighCritical · CVSS 7+ and EPSS

SQL Injection in parisneo/lollms-webui
- parisneo/lollms-webui
- SQL injection
Not analysed yet 16 Apr 2024
CVE-2024-1646 CVE record

CVSS 8.2 High

Authentication Bypass in parisneo/lollms-webui
- parisneo/lollms-webui
- Authentication bypass
Not analysed yet 16 Apr 2024
CVE-2024-1602 CVE record

CVSS 8.8 High

Stored XSS leading to RCE in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site scripting (XSS)
Not analysed yet 10 Apr 2024
CVE-2024-1520 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

OS Command Injection in parisneo/lollms-webui
- parisneo/lollms-webui
- Command injection
Not analysed yet 10 Apr 2024
CVE-2024-1511 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Path Traversal Vulnerability in parisneo/lollms-webui
- parisneo/lollms-webui
- Path traversal
Not analysed yet 10 Apr 2024
CVE-2024-1600 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+, CVSS 7+ and EPSS

Local File Inclusion in parisneo/lollms-webui
- parisneo/lollms-webui
- File inclusion
Not analysed yet 10 Apr 2024
CVE-2024-1522 CVE record

CVSS 8.8 High

Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui
- parisneo/lollms-webui
- Cross-site request forgery (CSRF)
Not analysed yet 30 Mar 2024