https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-5125.htmlhttps://patchthecve.com/cve/CVE-2024-5125.htmlWed, 17 Jun 2026 08:15:15 +0000HIGH 7.3: parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequate input validation and processing of SVG files during the upload process. The XSS vulnerability allows attackers to embed malicious JavaScript code within SVG files, which is executed uponhttps://patchthecve.com/cve/CVE-2024-6971.htmlhttps://patchthecve.com/cve/CVE-2024-6971.htmlWed, 17 Jun 2026 08:19:06 +0000MEDIUM 4.4: A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_file_system.py` file. The functions `add_rag_database`, `toggle_mount_rag_database`, and `vectorize_folder` do not implement security measures such as `sanitize_path_from_endpoint` or `sanitizehttps://patchthecve.com/cve/CVE-2024-4841.htmlhttps://patchthecve.com/cve/CVE-2024-4841.htmlWed, 17 Jun 2026 08:03:01 +0000LOW 3.3: A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_local_mode' function due to the lack of input sanitization. This vulnerability affects versions v9.6 to the latest. By exploiting this vulnerability, an attacker can predict the folders, subhttps://patchthecve.com/cve/CVE-2024-4403.htmlhttps://patchthecve.com/cve/CVE-2024-4403.htmlWed, 17 Jun 2026 08:01:49 +0000HIGH 8.8: A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF https://patchthecve.com/cve/CVE-2024-4267.htmlhttps://patchthecve.com/cve/CVE-2024-4267.htmlWed, 17 Jun 2026 08:01:33 +0000CRITICAL 9.8: A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open_file' module, version 9.5. The vulnerability arises due to improper neutralization of special elements used in a command within the 'open_file' function. An attacker can exploit this vulnerhttps://patchthecve.com/cve/CVE-2024-1646.htmlhttps://patchthecve.com/cve/CVE-2024-1646.htmlWed, 17 Jun 2026 07:04:41 +0000HIGH 8.2: parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized acchttps://patchthecve.com/cve/CVE-2024-1601.htmlhttps://patchthecve.com/cve/CVE-2024-1601.htmlWed, 17 Jun 2026 07:04:37 +0000CRITICAL 9.8: An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. The vulnerability is exploitable via a crafted HTTP POST request to the `/delete_discussion` endpoint, which internalhttps://patchthecve.com/cve/CVE-2024-1569.htmlhttps://patchthecve.com/cve/CVE-2024-1569.htmlWed, 17 Jun 2026 07:04:32 +0000HIGH 7.5: parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the