Medium severity · published Jun 27, 2024
CVE-2024-5933
Cross-site Scripting (XSS) in parisneo/lollms-webui
5.4
CVSS
0.4%
EPSS
No
On KEV
Description
A Cross-site Scripting (XSS) vulnerability exists in the chat functionality of parisneo/lollms-webui in the latest version. This vulnerability allows an attacker to inject malicious scripts via chat messages, which are then executed in the context of the user's browser.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PA
parisneo/lollms-webui · parisneo
through latest · source: vendor
LW
Lollms Web UI · Lollms
All versions, or not specified · source: NVD
LO
Lollms-webui · Parisneo
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5933
Exploit
https://huntr.com/bounties/51a2e370-3b64-45cd-9afc-0e4856ab5517
More from parisneo/lollms-webui
9.8
CVE-2024-8898
Path Traversal in parisneo/lollms-webui
9.8
CVE-2024-2359
Improper Neutralization of Special Elements used in an OS Command in parisneo/lollms-webui
9.8
CVE-2024-2360
Path Traversal leading to Remote Code Execution in parisneo/lollms-webui
9.8
CVE-2024-3322
Path Traversal in parisneo/lollms-webui
9.8
CVE-2024-4320
Remote Code Execution due to LFI in '/install_extension' in parisneo/lollms-webui