parisneo

5 results · Clear filters · Feed

• Critical 9.1
  CVE-2026-33340 Public exploit Scanner template EPSS 22%

  LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint

  LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems. A critical Server-Side Request Forgery (SSRF) vulnerability has been identified in all known existing versions of `lollms-webui`. The `@router.post("/api/proxy")`…

  parisneo lollms-webui
  Mar 24, 2026
• Medium 6.8
  CVE-2024-3121 Public exploit

  Remote Code Execution in create_conda_env function in parisneo/lollms

  A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary …

  parisneo parisneo/lollms lollms PyPI
  Jun 24, 2024
• Critical 9.8
  CVE-2024-4320 Public exploit EPSS 34%

  Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui

  A remote code execution (RCE) vulnerability exists in the '/install_extension' endpoint of the parisneo/lollms-webui application, specifically within the `@router.post("/install_extension")` route handler. The vulnerability arises due to improper handling of …

  parisneo parisneo/lollms-webui
  Jun 6, 2024
• High 8.4
  CVE-2024-3435 Public exploit

  Path Traversal in parisneo/lollms-webui

  A path traversal vulnerability exists in the 'save_settings' endpoint of the parisneo/lollms-webui application, affecting versions up to the latest release before 9.5. The vulnerability arises due to insufficient sanitization of the 'config' parameter in the …

  parisneo parisneo/lollms-webui
  May 16, 2024
• High 7.5
  CVE-2024-4322 Public exploit Scanner template EPSS 31%

  Path Traversal in parisneo/lollms-webui

  A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the `/list_personalities` endpoint. By manipulating the `category` parameter, an attacker can traverse the directory structure and list any directory on the sy…

  parisneo parisneo/lollms-webui
  May 16, 2024