CVE-2024-6986
Cross-site Scripting (XSS) in parisneo/lollms-webui
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Cross-site Scripting (XSS) in parisneo/lollms-webui
A Cross-site Scripting (XSS) vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'full_template' variable directly as HTML. This allows an attacker to execute malicious JavaScript code by injecting a payload into the 'System Template' input field under main configurations.
Reserved 2024-07-22 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
huntr.com/bounties/83e9bde1-40b2-49e9-be1c-bc1498eb8ebd
Support options
