Stored XSS Vulnerability in Parisneo's Lollms-webui Application

CVE-2024-2299

What is CVE-2024-2299?

The Lollms-WebUI application developed by Parisneo has a stored Cross-Site Scripting (XSS) vulnerability resulting from inadequate validation of uploaded files in the profile picture upload feature. This flaw allows attackers to upload malicious HTML files embedded with JavaScript code. When these files are accessed, the harmful scripts are executed in the context of the application. This vulnerability can be exploited remotely through Cross-Site Request Forgery (CSRF), enabling attackers to conduct actions on behalf of authenticated users and potentially gain unauthorized access to sensitive data stored within the Lollms-WebUI application.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References