CVEs

• CVE-2023-25828 RCE in Pluck CMS via web-shell smuggling in JPEG
• CVE-2023-2453 RCE in PHPFusion via LFI on arbitrary '.php' file
• CVE-2023-51448 Blind SQL injection in Cacti
• CVE-2024-54445 Blind SQL injection in LogicalDOC
• CVE-2024-54446 Blind SQL injection in LogicalDOC
• CVE-2024-54447 Blind SQL injection in LogicalDOC
• CVE-2024-54448 RCE in LogicalDOC via DSL scripting
• CVE-2024-54449 RCE via arbitrary file write path traversal in LogicalDOC
• CVE-2024-12019 Arbitrary file read path traversal in LogicalDOC
• CVE-2025-64495 Open WebUI Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' ATO/RCE
• CVE-2026-44549 Open WebUI Stored XSS in Excel file preview ATO/RCE
• CVE-2026-26192 Open WebUI Stored XSS via iFrame in citations model ATO/RCE
• CVE-2026-26193 Open WebUI Stored XSS via iFrame embeds in response messages ATO/RCE
• CVE-2026-34225 Open WebUI Blind Server Side Request Forgery in its Image Edit Functionality
• CVE-2026-59214 Open WebUI: Stored web worker XSS via Pyodide ATO/RCE
• (pending?) Stored XSS in yarr via iFrame
• (pending?) Pre-auth RCE in Neos CMS

Mostly up to date