Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-6986Cross-site Scripting (XSS) in parisneo/lollms-webui

Medium 5.5

In plain English

A medium-severity cross-site scripting in parisneo/lollms-webui from parisneo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.0)5.5Medium

Exploit odds (30 days)0.3%top 76.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A Cross-site Scripting (XSS) vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'full_template' variable directly as HTML. This allows an attacker to execute malicious JavaScript code by injecting a payload into the 'System Template' input field under main configurations.

Affected products (as reported)

Vendor	Product	Versions
parisneo	parisneo/lollms-webui	unspecified – through latest

Weakness: CWE-79 · Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N

References

https://huntr.com/bounties/83e9bde1-40b2-49e9-be1c-bc1498eb8ebd