Vendor
parisneo
84 known vulnerabilities.
84 results · Feed
-
Critical 9.8CVE-2024-1520 EPSS 48%
OS Command Injection in parisneo/lollms-webui
An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. Attackers can exploit this vulnerability by injectin…
-
Critical 9.8
Path Traversal Vulnerability in parisneo/lollms-webui
The parisneo/lollms-webui repository is susceptible to a path traversal vulnerability due to inadequate validation of user-supplied file paths. This flaw allows an unauthenticated attacker to read, write, and in certain configurations execute arbitrary files …
-
Critical 9.3CVE-2024-1600 EPSS 33%
Local File Inclusion in parisneo/lollms-webui
A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. An attacker can exploit this vulnerability by crafting a URL that includes directory traversal sequences (`../../`) fol…
-
High 8.8
Cross-Site Request Forgery (CSRF) Leading to Remote Code Execution in parisneo/lollms-webui
A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requ…