CVE-2024-5125

parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed upon rendering, leading to potential credential theft and unauthorized data access. The Open Redirect vulnerability arises from insufficient URL validation within SVG files, enabling attackers to redirect users to malicious websites, thereby exposing them to phishing attacks, malware distribution, and reputation damage. These vulnerabilities are present in the application's functionality to send files to the AI module.

• CWE-79

• https://github.com/parisneo/lollms-webui/commit/9b0f6c4ad1b9a2cd3466dcefaa278df30feed67ePatch
• https://huntr.com/bounties/e6ae8cfd-9f8b-41df-a0cc-1e7a47416995Exploit, Third Party Advisory
• https://huntr.com/bounties/e6ae8cfd-9f8b-41df-a0cc-1e7a47416995Exploit, Third Party Advisory

Published

Nov 14, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-51244In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8.8
• CVE-2024-51245In DrayTek Vigor3900 1.5.1.3, attackers can inject malicious…8.8
• CVE-2024-51246In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8
• CVE-2024-51247In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8.8
• CVE-2024-51248In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8.8
• CVE-2024-51249In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8
• CVE-2024-51251In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8
• CVE-2024-51252In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…9.8
• CVE-2024-51253In Draytek Vigor3900 1.5.1.3, attackers can inject malicious…8
• CVE-2024-51254DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicio…8.8
• CVE-2024-51255DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicio…9.8
• CVE-2024-51257DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicio…8.8