parisneo vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-10595 A path traversal vulnerability exists in parisneo/lollms version 2.1.0, specifically in the SPA catch-all route implemented in `backend/routers/ui.py`.High 7.5 · Aug 9, 2026
• CVE-2026-1115 A Stored Cross-Site Scripting (XSS) vulnerability was identified in the social feature of parisneo/lollms, affecting the latest version prior to 2.2.0.Critical 9.6 · Apr 10, 2026
• CVE-2026-1114 In parisneo/lollms version 2.1.0, the application's session management is vulnerable to improper access control due to the use of a weak secret key for signing Critical 9.8 · Apr 7, 2026
• CVE-2026-0562 A critical security vulnerability in parisneo/lollms versions up to 2.2.0 allows any authenticated user to accept or reject friend requests belonging to other uHigh 8.3 · Mar 29, 2026
• CVE-2026-0560 A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint.High 7.5 · Mar 29, 2026
• CVE-2026-0558 A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-Critical 9.8 · Mar 29, 2026
• CVE-2026-33340 LoLLMs WEBUI provides the Web user interface for Lord of Large Language and Multi modal Systems.Critical 9.1 · Mar 24, 2026
• CVE-2024-2356 A Local File Inclusion (LFI) vulnerability exists in the '/reinstall_extension' endpoint of the parisneo/lollms-webui application, specifically within the `nameCritical 9.6 · Feb 2, 2026
• CVE-2026-1117 A vulnerability in the `lollms_generation_events.py` component of parisneo/lollms version 5.9.0 allows unauthenticated access to sensitive Socket.IO events.High 8.2 · Feb 2, 2026
• CVE-2025-6386 The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file.High 7.5 · Jul 7, 2025
• CVE-2025-1451 A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads.High 7.5 · Mar 20, 2025
• CVE-2024-9920 In version v12 of parisneo/lollms-webui, the 'Send file to AL' function allows uploading files with various extensions, including potentially dangerous ones likHigh 8.8 · Mar 20, 2025
• CVE-2024-9919 A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions.High 8.4 · Mar 20, 2025
• CVE-2024-9597 A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the systeHigh 7.1 · Mar 20, 2025
• CVE-2024-8898 A path traversal vulnerability exists in the `install` and `uninstall` API endpoints of parisneo/lollms-webui version V12 (Strawberry).Critical 9.8 · Mar 20, 2025
• CVE-2024-8581 A vulnerability in the `upload_app` function of parisneo/lollms-webui V12 (Strawberry) allows an attacker to delete any file or directory on the system.Critical 9.1 · Mar 20, 2025
• CVE-2024-6982 A remote code execution vulnerability exists in the Calculate function of parisneo/lollms version 9.8.High 8.4 · Mar 20, 2025
• CVE-2024-12766 parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API.High 7.5 · Mar 20, 2025
• CVE-2024-11302 A missing check_access() function in the lollms_binding_infos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and removeHigh 8 · Mar 20, 2025
• CVE-2024-5125 parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files dHigh 7.3 · Nov 14, 2024
• CVE-2024-6674 A CORS misconfiguration in parisneo/lollms-webui prior to version 10 allows attackers to steal sensitive information such as logs, browser sessions, and settingHigh 7.1 · Oct 29, 2024
• CVE-2024-6581 A vulnerability in the discussion image upload function of the Lollms application, version v9.9, allows for the uploading of SVG files.Critical 9 · Oct 29, 2024
• CVE-2024-6959 A vulnerability in parisneo/lollms-webui version 9.8 allows for a Denial of Service (DOS) attack when uploading an audio file.High 7.1 · Oct 13, 2024
• CVE-2024-6394 A Local File Inclusion vulnerability exists in parisneo/lollms-webui versions below v9.8.High 7.5 · Sep 30, 2024
• CVE-2024-6040 In parisneo/lollms-webui version v9.8, the lollms_binding_infos is missing the client_id parameter, which leads to multiple security vulnerabilities.High 8.8 · Aug 1, 2024