CVE-2024-6986 — Cross-site Scripting (XSS) in parisneo/lollms-webui
A Cross-site Scripting (XSS) vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directi…
Published: 2025-03-20 · CVSS: 5.5 · CVSS 3.0
A Cross-site Scripting (XSS) vulnerability exists in the Settings page of parisneo/lollms-webui version 9.8. The vulnerability is due to the improper use of the 'v-html' directive, which inserts the content of the 'full_template' variable directly as HTML. This allows an attacker to execute malicious JavaScript code by injecting a payload into the 'System Template' input field under main configurations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7