Security Vulnerabilities
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
CVSS Score
4.3
EPSS Score
0.0
Published
2025-12-04
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-12-04
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-12-04
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
CVSS Score
7.5
EPSS Score
0.0
Published
2025-12-04
A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api&m=test_site_domain of the component Project Domain Change Test. This manipulation of the argument v causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score
4.7
EPSS Score
0.0
Published
2025-12-04
A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files.
CVSS Score
5.4
EPSS Score
0.0
Published
2025-12-04
A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information.
CVSS Score
4.3
EPSS Score
0.0
Published
2025-12-04
A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files.
CVSS Score
4.3
EPSS Score
0.0
Published
2025-12-04
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
CVSS Score
7.2
EPSS Score
0.0
Published
2025-12-04
A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95.php?c=field&m=add&rname=site&rid=1&page=1 of the component Add Data Validation Page. The manipulation of the argument data[name] leads to cross site scripting. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Score
3.5
EPSS Score
0.0
Published
2025-12-04
Page 1