Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ion permits the creation of a new admin user without requiring a password, leading to unauthorized administrative access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/c114c03e-3348-450f-88f7-538502047bcc - https://github.com/mintplex-labs/anything-llm/commit/52fac844221a9b951d08ceb93c4c014e9397b1f2
CVE ID: CVE-2024-3102 State: PUBLISHED Published: 2024-06-06T18:19:23.450Z Last Updated: 2024-11-03T18:27:23.547Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-307 Description: A JSON Injection vulnerability exists in the `mintplex-labs/anything-llm` application, specifically within the username parameter during the login process at the `/api/request-token` endpoint. The vulnerability arises from improper handling of values, allowing attackers to perform brute force attacks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascerta
acks without prior knowledge of the username. Once the password is known, attackers can conduct blind attacks to ascertain the full username, significantly compromising system security. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/8af4650d-5955-44a4-86b4-d08e1c862b49 - https://github.com/mintplex-labs/anything-llm/commit/2374939ffb551ab2929d7f9d5827fe6597fa8caa
CVE ID: CVE-2024-3103 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:37.475Z Description: No description available.
CVE ID: CVE-2024-3104 State: PUBLISHED Published: 2024-06-06T17:50:18.630Z Last Updated: 2024-08-01T19:32:42.539Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-78 Description: A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables. Attackers can exploit this vulnerability by injecting arbitrary environment variables via the `POST /api/system/update-env` endpoint, which allows for the execution of arbitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with
bitrary code on the host running anything-llm. The vulnerability is present in the latest version of anything-llm, with the latest commit identified as fde905aac1812b84066ff72e5f2f90b56d4c3a59. This issue has been fixed in version 1.0.0. Successful exploitation could lead to code execution on the host, enabling attackers to read and modify data accessible to the user running the service, potentially leading to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/4f2fcb45-5828-4bec-985a-9d3a0ee00462 - https://github.com/mintplex-labs/anything-llm/commit/bfedfebfab032e6f4d5a369c8a2f947c5d0c5286
CVE ID: CVE-2024-3105 State: PUBLISHED Published: 2024-06-15T08:42:14.653Z Last Updated: 2024-08-09T20:09:19.278Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: webcraftic Products: Woody code snippets – Insert Header Footer Code, AdSense Ads Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.5.0 via the 'insert_php' shortcode. This is due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possibl
s due to the plugin not restricting the usage of the functionality to high level authorized users. This makes it possible for authenticated attackers, with contributor-level access and above, to execute code on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/134ad095-b0a0-4f0f-832d-3e558d4a250a?source=cve - https://plugins.trac.wordpress.org/browser/insert-php/trunk/includes/class.plugin.php#L166 - https://plugins.trac.wordpress.org/browser/insert-php/trunk/includes/shortcodes/shortcode-insert-php.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&ol
es/shortcodes/shortcode-insert-php.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3102522%40insert-php&new=3102522%40insert-php&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3107 State: PUBLISHED Published: 2024-05-02T16:51:46.405Z Last Updated: 2024-08-01T19:32:42.699Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: brainstormforce Products: Spectra – WordPress Gutenberg Blocks Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Spectra – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 2.12.6 via the get_block_default_attributes function. This allows authenticated attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the
attackers, with contributor-level permissions and above, to read the contents of any files named attributes.php on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/110e5e67-b318-4ab2-9b4d-59aabcf7db7c?source=cve - https://plugins.trac.wordpress.org/browser/ultimate-addons-for-gutenberg/trunk/classes/class-uagb-block-module.php#L189 - https://plugins.trac.wordpress.org/changeset/3062684/
CVE ID: CVE-2024-3108 State: PUBLISHED Published: 2024-05-03T14:06:53.248Z Last Updated: 2024-08-01T19:32:42.745Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Motorola Products: Phones Problem Types: CWE-927 Description: An implicit intent vulnerability was reported for Motorola’s Time Weather Widget application that could allow a local application to acquire the location of the device without authorization. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/178863
CVE ID: CVE-2024-3109 State: PUBLISHED Published: 2024-05-03T14:09:59.372Z Last Updated: 2024-08-01T19:32:42.671Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Motorola Products: Phones Problem Types: CWE-321 Description: A hard-coded AES key vulnerability was reported in the Motorola GuideMe application, along with a lack of URI sanitation, could allow for a local attacker to read arbitrary files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://en-us.support.motorola.com/app/answers/detail/a_id/178863
CVE ID: CVE-2024-3110 State: PUBLISHED Published: 2024-06-06T18:11:33.357Z Last Updated: 2024-08-01T19:32:42.667Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-79 Description: A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0. The vulnerability arises from the application's failure to properly sanitize and validate user-supplied URLs before embedding them into the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion
nto the application UI as external links with custom icons. Specifically, the application does not prevent the inclusion of 'javascript:' protocol payloads in URLs, which can be exploited by a user with manager role to execute arbitrary JavaScript code in the context of another user's session. This flaw can be leveraged to steal the admin's authorization token by crafting malicious URLs that, when clicked by the admin, send the token to an attacker-controlled server. The attacker can then use this token to perform unauthorized actions, escalate privileges to admin, or directly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using eit
tly take over the admin account. The vulnerability is triggered when the malicious link is opened in a new tab using either the CTRL + left mouse button click or the mouse scroll wheel click, or in some non-updated versions of modern browsers, by directly clicking on the link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/c2895978-364d-412d-8825-c806606bcb85 - https://github.com/mintplex-labs/anything-llm/commit/49f30e051c9f6e28977d57d0e5f49c1294094e41
CVE ID: CVE-2024-3111 State: PUBLISHED Published: 2024-06-27T06:00:03.428Z Last Updated: 2024-08-01T19:32:42.873Z Vendors: Unknown Products: Interactive Content Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Interactive Content WordPress plugin before 1.15.8 does not validate uploads which could allow a Contributors and above to update malicious SVG files, leading to Stored Cross-Site Scripting issues Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/7c39f3b5-d407-4eb0-aa34-b498fe196c55/
CVE ID: CVE-2024-3112 State: PUBLISHED Published: 2024-07-12T06:00:05.645Z Last Updated: 2024-08-01T19:32:42.695Z Vendors: Unknown Products: Quotes and Tips by BestWebSoft Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Quotes and Tips by BestWebSoft WordPress plugin before 1.45 does not properly validate image files uploaded, allowing high privilege users such as admin to upload arbitrary files on the server even when they should not be allowed to (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/fa6f01d6-aa3b-4452-9c5f-49bb227fea9d/
CVE ID: CVE-2024-3113 State: PUBLISHED Published: 2024-07-30T06:00:06.437Z Last Updated: 2024-08-01T19:32:42.701Z Vendors: Unknown Products: FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin before 2.12.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Co
ility is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/ad85c5c7-f4d1-4374-b3b7-8ee022d27d34/
CVE ID: CVE-2024-3114 State: PUBLISHED Published: 2024-08-08T10:31:22.868Z Last Updated: 2024-08-30T13:24:42.884Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: CWE-1333 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 11.10 prior to 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2, with the processing logic for parsing invalid commits can lead to a regular expression DoS attack on the server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452547 - https://hackerone.com/reports/2416630
CVE ID: CVE-2024-3115 State: PUBLISHED Published: 2024-06-26T23:31:35.425Z Last Updated: 2024-08-30T13:24:42.967Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-862 Description: An issue was discovered in GitLab EE affecting all versions starting from 16.0 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, which allows an attacker to access issues and epics without having an SSO session using Duo Chat. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452548 - https://hackerone.com/report
CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452548 - https://hackerone.com/reports/2417868
CVE ID: CVE-2024-3116 State: PUBLISHED Published: 2024-04-04T14:59:37.280Z Last Updated: 2025-03-14T16:35:25.051Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: pgadmin.org Products: pgAdmin 4 Description: pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system's integrity and the security of the underlying data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pgadmin-org/pgadmin4/issues/7326 - http
CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/pgadmin-org/pgadmin4/issues/7326 - https://gist.github.com/aelmokhtar/689a8be7e3bd535ec01992d8ec7b2b98 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIF5T34JTTYRGIN5YPT366BDFG6452A2/
CVE ID: CVE-2024-3117 State: PUBLISHED Published: 2024-03-31T01:31:03.901Z Last Updated: 2024-08-15T15:51:06.371Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: YouDianCMS Problem Types: CWE-434 Description: A vulnerability classified as critical was found in YouDianCMS up to 9.5.12. This vulnerability affects unknown code of the file App\Lib\Action\Admin\ChannelAction.class.php. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure b
DB-258778 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258778 - https://vuldb.com/?ctiid.258778 - https://vuldb.com/?submit.302925 - https://github.com/Luci4n555/CVE-Report/blob/main/YouDianCMS9.5.12.md
CVE ID: CVE-2024-3118 State: PUBLISHED Published: 2024-03-31T04:31:04.530Z Last Updated: 2024-08-01T19:32:42.609Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Dreamer Products: CMS Problem Types: CWE-275 Description: A vulnerability, which was classified as critical, has been found in Dreamer CMS up to 4.1.3. This issue affects some unknown processing of the component Attachment Handler. The manipulation leads to permission issues. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258779. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-258779. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258779 - https://vuldb.com/?ctiid.258779 - https://vuldb.com/?submit.303196 - https://github.com/sweatxi/BugHub/blob/main/dreamer_Excessive_authority.pdf
CVE ID: CVE-2024-3119 State: PUBLISHED Published: 2024-04-09T23:55:43.501Z Last Updated: 2024-08-08T21:20:41.031Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: irontec Products: sngrep Problem Types: CWE-120 Description: A buffer overflow vulnerability exists in all versions of sngrep since v0.4.2, due to improper handling of 'Call-ID' and 'X-Call-ID' SIP headers. The functions sip_get_callid and sip_get_xcallid in sip.c use the strncpy function to copy header contents into fixed-size buffers without checking the data length. This flaw allows remote attackers to execute arbitrary code or cause a denial of service (DoS) through specially crafted SIP message
lows remote attackers to execute arbitrary code or cause a denial of service (DoS) through specially crafted SIP messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/irontec/sngrep/pull/480/commits/73c15c82d14c69df311e05fa75da734faafd365f - https://github.com/irontec/sngrep/releases/tag/v1.8.1 - https://pentraze.com/vulnerability-reports/
CVE ID: CVE-2024-3120 State: PUBLISHED Published: 2024-04-09T23:55:57.410Z Last Updated: 2025-02-21T17:07:41.626Z Severity: CRITICAL (CVSS 9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: irontec Products: sngrep Problem Types: CWE-120 Description: A stack-buffer overflow vulnerability exists in all versions of sngrep since v1.4.1. The flaw is due to inadequate bounds checking when copying 'Content-Length' and 'Warning' headers into fixed-size buffers in the sip_validate_packet and sip_parse_extra_headers functions within src/sip.c. This vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via crafted SIP messages. Additional Analyst Note
attackers to execute arbitrary code or cause a denial of service (DoS) via crafted SIP messages. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/irontec/sngrep/pull/480/commits/f229a5d31b0be6a6cc3ab4cd9bfa4a1b5c5714c6 - https://github.com/irontec/sngrep/releases/tag/v1.8.1 - https://pentraze.com/vulnerability-reports/
CVE ID: CVE-2024-3121 State: PUBLISHED Published: 2024-06-24T00:00:14.165Z Last Updated: 2024-08-01T19:32:42.719Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms Problem Types: CWE-94 Description: A remote code execution vulnerability exists in the create_conda_env function of the parisneo/lollms repository, version 5.9.0. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the env_name and python_version parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami'
n parameters. This issue could lead to a serious security breach as demonstrated by the ability to execute the 'whoami' command among potentially other harmful commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/db57c343-9b80-4c1c-9ab0-9eef92c9b27b
CVE ID: CVE-2024-3122 State: PUBLISHED Published: 2024-07-01T02:39:14.560Z Last Updated: 2024-08-01T19:32:42.703Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: CHANGING Products: Mobile One Time Password Problem Types: CWE-23 Description: CHANGING Mobile One Time Password does not properly filter parameters for the file download functionality, allowing remote attackers with administrator privilege to read arbitrary file on the system. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7911-0962e-1.html - https://www.twcert.org.tw/en/cp-139-7912-4c800-2.html
CVE ID: CVE-2024-3123 State: PUBLISHED Published: 2024-07-01T02:52:34.721Z Last Updated: 2024-08-01T19:32:42.884Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: CHANGING Products: Mobile One Time Password Problem Types: CWE-434 Description: CHANGING Mobile One Time Password's uploading function in a hidden page does not filter file type properly. Remote attackers with administrator privilege can exploit this vulnerability to upload and run malicious file to execute system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7913-6528e-1.html - https://www.twcert.org.tw/en/cp-13
gram Container: References: - https://www.twcert.org.tw/tw/cp-132-7913-6528e-1.html - https://www.twcert.org.tw/en/cp-139-7914-33fbb-2.html
CVE ID: CVE-2024-3124 State: PUBLISHED Published: 2024-04-01T12:31:04.539Z Last Updated: 2024-08-27T15:38:16.509Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: fridgecow Products: smartalarm Problem Types: CWE-530 Description: A vulnerability classified as problematic has been found in fridgecow smartalarm 1.8.1 on Android. This affects an unknown part of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The associated identifier of this v
n the physical device. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258867. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258867 - https://vuldb.com/?ctiid.258867 - https://vuldb.com/?submit.307752 - https://github.com/ctflearner/Android_Findings/blob/main/Smartalarm/Backup.md
CVE ID: CVE-2024-3125 State: PUBLISHED Published: 2024-04-01T14:00:04.923Z Last Updated: 2024-08-01T19:32:42.857Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Zebra Products: ZTC GK420d Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in Zebra ZTC GK420d 1.0. This vulnerability affects unknown code of the file /settings of the component Alert Setup Page. The manipulation of the argument Address leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258868. NOTE: The vendor was contacted early about this disclosure but di
d. The identifier of this vulnerability is VDB-258868. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258868 - https://vuldb.com/?ctiid.258868 - https://vuldb.com/?submit.303446 - https://github.com/strik3r0x1/Vulns/blob/main/ZTC_GK420d-SXSS.md
CVE ID: CVE-2024-3126 State: PUBLISHED Published: 2024-05-16T09:03:47.640Z Last Updated: 2024-08-01T19:32:42.607Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-78 Description: A command injection vulnerability exists in the 'run_xtts_api_server' function of the parisneo/lollms-webui application, specifically within the 'lollms_xtts.py' script. The vulnerability arises due to the improper neutralization of special elements used in an OS command. The affected function utilizes 'subprocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url'
ocess.Popen' to execute a command constructed with a Python f-string, without adequately sanitizing the 'xtts_base_url' input. This flaw allows attackers to execute arbitrary commands remotely by manipulating the 'xtts_base_url' parameter. The vulnerability affects versions up to and including the latest version before 9.5. Successful exploitation could lead to arbitrary remote code execution (RCE) on the system where the application is deployed. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/0e2bec70-826e-4c24-8015-31921e23fd12 - https://github.com/parisneo/lollms-webui/commit/41dbb1b3f2e78ea276e5269544e50514252c0c25