lollms records
68 published records for vendor lollms.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 12
- With a fix record
- 17.6%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-29 Path Traversal: '\..\filename'11
- CWE-352 Cross-Site Request Forgery (CSRF)9
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')9
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')7
- CWE-36 Absolute Path Traversal5
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')4
The weakness classes this vendor ships most often: where to look.
CWEAll records
68 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
53Plan | CVE-2024-1520No exploit | OS Command Injection in parisneo/lollms-webuilollms · lollms web ui · CWE-78 | Critical9.8 | — | 48.2% | Apr 10, 2024 |
51Plan | CVE-2024-1601No exploit | SQL Injection in parisneo/lollms-webuilollms · lollms-webui · CWE-89 | Critical9.8 | — | 40.4% | Apr 15, 2024 |
49Plan | CVE-2024-4320Proof of concept | Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webuilollms · lollms web ui · CWE-29 | Critical9.8 | — | 34.3% | Jun 6, 2024 |
47Plan | CVE-2024-1600No exploit | Local File Inclusion in parisneo/lollms-webuilollms · lollms web ui · CWE-98 | Critical9.3 | — | 32.5% | Apr 10, 2024 |
47Plan | CVE-2024-3429No exploit | Path Traversal in parisneo/lollmslollms · lollms · CWE-29 | Critical9.8 | — | 28.3% | Jun 6, 2024 |
43Plan | CVE-2026-33340Proof of concept | LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpointlollms · lollms web ui · CWE-306 | Critical9.1 | — | 22.0% | Mar 24, 2026 |
40Plan | CVE-2024-1873No exploit | Path Traversal and Denial of Service in parisneo/lollms-webuilollms · lollms web ui · CWE-22 | Critical9.1 | — | 13.3% | Jun 6, 2024 |
40Plan | CVE-2026-0558Proof of concept | Unauthenticated File Upload in parisneo/lollmslollms · lollms · CWE-287 | Critical9.8 | — | 2.0% | Mar 29, 2026 |
40Plan | CVE-2024-2360No exploit | Path Traversal leading to Remote Code Execution in parisneo/lollms-webuilollms · lollms web ui · CWE-29 | Critical9.8 | — | 1.8% | Jun 6, 2024 |
39Monitor | CVE-2024-4322Proof of concept | Path Traversal in parisneo/lollms-webuilollms · lollms web ui · CWE-29 | High7.5 | — | 30.7% | May 16, 2024 |
39Monitor | CVE-2024-4267No exploit | Remote Code Execution in parisneo/lollms-webuilollms · lollms-webui · CWE-77 | Critical9.8 | — | 1.4% | May 22, 2024 |
39Monitor | CVE-2024-2624No exploit | Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webuilollms · lollms web ui · CWE-29 | Critical9.8 | — | 1.3% | Jun 6, 2024 |
39Monitor | CVE-2024-2359No exploit | Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webuilollms · lollms web ui · CWE-78 | Critical9.8 | — | 1.2% | Jun 6, 2024 |
39Monitor | CVE-2024-2358No exploit | Path Traversal leading to Remote Code Execution in parisneo/lollms-webuilollms · lollms web ui · CWE-29 | Critical9.8 | — | 1.1% | May 16, 2024 |
39Monitor | CVE-2024-1511No exploit | Path Traversal Vulnerability in parisneo/lollms-webuilollms · lollms web ui · CWE-22 | Critical9.8 | — | 0.9% | Apr 10, 2024 |
39Monitor | CVE-2024-4326No exploit | Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webuilollms · lollms web ui · CWE-15 | Critical9.8 | — | 0.9% | May 16, 2024 |
39Monitor | CVE-2024-8898No exploit | Path Traversal in parisneo/lollms-webuilollms · lollms web ui · CWE-22 | Critical9.8 | — | 0.8% | Mar 20, 2025 |
39Monitor | CVE-2024-3322No exploit | Path Traversal in parisneo/lollms-webuilollms · lollms web ui · CWE-22 | Critical9.8 | — | 0.7% | Jun 6, 2024 |
39Monitor | CVE-2024-5482No exploit | SSRF in add_webpage endpoint in parisneo/lollms-webuilollms · lollms web ui · CWE-918 | Critical9.8 | — | 0.6% | Jun 6, 2024 |
39Monitor | CVE-2026-1114No exploit | Improper Access Control via Weak JWT Token in parisneo/lollmslollms · lollms · CWE-284 | Critical9.8 | — | 0.5% | Apr 7, 2026 |
38Monitor | CVE-2026-1115Proof of concept | Stored XSS in parisneo/lollmslollms · lollms · CWE-79 | Critical9.6 | — | 1.2% | Apr 10, 2026 |
38Monitor | CVE-2024-2361No exploit | Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webuilollms · lollms web ui · CWE-29 | Critical9.6 | — | 0.6% | May 16, 2024 |
36Monitor | CVE-2024-2362No exploit | Path Traversal in parisneo/lollms-webuilollms · lollms web ui · CWE-36 | Critical9.1 | — | 1.1% | Jun 6, 2024 |
36Monitor | CVE-2024-8581No exploit | Path Traversal in parisneo/lollms-webuilollms · lollms web ui · CWE-22 | Critical9.1 | — | 0.9% | Mar 20, 2025 |
36Monitor | CVE-2024-2366No exploit | Remote Code Execution in parisneo/lollms-webuilollms · lollms web ui · CWE-77 | Critical9.0 | — | 0.6% | May 16, 2024 |
- CVE-2024-152053Plan
OS Command Injection in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 48%lollms · lollms web uiApr 10, 2024
- CVE-2024-160151Plan
SQL Injection in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 40%lollms · lollms-webuiApr 15, 2024
- CVE-2024-432049Plan
Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui
CriticalCVSS 9.8Proof of conceptEPSS 34%lollms · lollms web uiJun 6, 2024
- CVE-2024-160047Plan
Local File Inclusion in parisneo/lollms-webui
CriticalCVSS 9.3No exploitEPSS 32%lollms · lollms web uiApr 10, 2024
- CVE-2024-342947Plan
Path Traversal in parisneo/lollms
CriticalCVSS 9.8No exploitEPSS 28%lollms · lollmsJun 6, 2024
- CVE-2026-3334043Plan
LoLLMs WEBUI has unauthenticated Server-Side Request Forgery (SSRF) in /api/proxy endpoint
CriticalCVSS 9.1Proof of conceptEPSS 22%lollms · lollms web uiMar 24, 2026
- CVE-2024-187340Plan
Path Traversal and Denial of Service in parisneo/lollms-webui
CriticalCVSS 9.1No exploitEPSS 13%lollms · lollms web uiJun 6, 2024
- CVE-2026-055840Plan
Unauthenticated File Upload in parisneo/lollms
CriticalCVSS 9.8Proof of conceptEPSS 2%lollms · lollmsMar 29, 2026
- CVE-2024-236040Plan
Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 1%lollms · lollms web uiJun 6, 2024
- CVE-2024-432239Monitor
Path Traversal in parisneo/lollms-webui
HighCVSS 7.5Proof of conceptEPSS 30%lollms · lollms web uiMay 16, 2024
- CVE-2024-426739Monitor
Remote Code Execution in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 1%lollms · lollms-webuiMay 22, 2024
- CVE-2024-262439Monitor
Path Traversal and Arbitrary File Upload Vulnerability in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 1%lollms · lollms web uiJun 6, 2024
- CVE-2024-235939Monitor
Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 1%lollms · lollms web uiJun 6, 2024
- CVE-2024-235839Monitor
Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 1%lollms · lollms web uiMay 16, 2024
- CVE-2024-151139Monitor
Path Traversal Vulnerability in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 0%lollms · lollms web uiApr 10, 2024
- CVE-2024-432639Monitor
Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 0%lollms · lollms web uiMay 16, 2024
- CVE-2024-889839Monitor
Path Traversal in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 0%lollms · lollms web uiMar 20, 2025
- CVE-2024-332239Monitor
Path Traversal in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 0%lollms · lollms web uiJun 6, 2024
- CVE-2024-548239Monitor
SSRF in add_webpage endpoint in parisneo/lollms-webui
CriticalCVSS 9.8No exploitEPSS 0%lollms · lollms web uiJun 6, 2024
- CVE-2026-111439Monitor
Improper Access Control via Weak JWT Token in parisneo/lollms
CriticalCVSS 9.8No exploitEPSS 0%lollms · lollmsApr 7, 2026
- CVE-2026-111538Monitor
Stored XSS in parisneo/lollms
CriticalCVSS 9.6Proof of conceptEPSS 1%lollms · lollmsApr 10, 2026
- CVE-2024-236138Monitor
Arbitrary Upload & Read via Path Traversal in parisneo/lollms-webui
CriticalCVSS 9.6No exploitEPSS 0%lollms · lollms web uiMay 16, 2024
- CVE-2024-236236Monitor
Path Traversal in parisneo/lollms-webui
CriticalCVSS 9.1No exploitEPSS 1%lollms · lollms web uiJun 6, 2024
- CVE-2024-858136Monitor
Path Traversal in parisneo/lollms-webui
CriticalCVSS 9.1No exploitEPSS 0%lollms · lollms web uiMar 20, 2025
- CVE-2024-236636Monitor
Remote Code Execution in parisneo/lollms-webui
CriticalCVSS 9.0No exploitEPSS 0%lollms · lollms web uiMay 16, 2024