Tag
Open WebUI: Realtime Endpoints Fail to Revoke JWTs
1 TTP 1 CVEOpen WebUI versions from 0.9.0 to before 0.10.0, when configured with Redis, fail to correctly enforce JWT revocation for realtime authentication endpoints such as Socket.IO and terminal websockets, allowing attackers to maintain access to real-time features with stolen, revoked JWTs.
HCL BigFix WebUI Information Disclosure Vulnerabilities
2 rules 1 TTPA remote, authenticated attacker can exploit multiple vulnerabilities in HCL BigFix WebUI applications to disclose sensitive information.
Pelican Web UI Privilege Escalation Vulnerability
2 rules 1 TTP 1 IOCA privilege escalation vulnerability in Pelican WebUI versions v7.21 to v7.24 allows authenticated users to gain admin privileges by manipulating database records, potentially leading to configuration modification, API token creation, and password changes.
Hermes WebUI Arbitrary File Deletion Vulnerability (CVE-2026-6832)
2 rules 1 TTP 1 CVEHermes WebUI is vulnerable to arbitrary file deletion via path traversal in the /api/session/delete endpoint due to insufficient validation of the session_id parameter, allowing authenticated attackers to delete writable JSON files on the host system.