ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.Supporting sources are pending verification.
XSS and Open Redirect via SVG File Upload in lollms-webui
LoLLMS WebUI had XSS and open redirect vulnerabilities in SVG file upload functionality, identified as CVE-2024-5125. The vulnerabilities were fixed through code updates.
AII-1002-51911
What happened
LoLLMS WebUI contained vulnerabilities allowing cross-site scripting (XSS) and open redirect attacks through SVG file uploads.
A fix was applied in commit 9b0f6c4 updating assets and configuration files.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.