Web Ui
Monthly
Cleartext API key storage in browser-use web-ui versions 2.0.0 through 3.0.0 exposes configured LLM provider credentials to any local user with filesystem read access. The application writes API keys to predictably-named JSON files in a temporary settings directory without encryption or access controls, as identified in src/webui/webui_manager.py. An attacker who gains read access to that directory can silently harvest credentials and use them to impersonate the victim against third-party LLM APIs, incurring charges or extracting data. No public exploit code has been identified at time of analysis.
Arbitrary directory creation in browser-use web-ui 2.0.0-3.0.0 allows remote unauthenticated attackers to create directories at any path writable by the root-running container. The `run_agent_task` function passes user-supplied `save_recording_path`, `save_trace_path`, `save_agent_history_path`, and `save_download_path` values directly to filesystem operations without sanitizing absolute path inputs. Because the Gradio interface requires no authentication and containers commonly run as root, the effective write surface spans the entire container filesystem. No public exploit has been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web servers to inject arbitrary web script or HTML via the server header. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Cleartext API key storage in browser-use web-ui versions 2.0.0 through 3.0.0 exposes configured LLM provider credentials to any local user with filesystem read access. The application writes API keys to predictably-named JSON files in a temporary settings directory without encryption or access controls, as identified in src/webui/webui_manager.py. An attacker who gains read access to that directory can silently harvest credentials and use them to impersonate the victim against third-party LLM APIs, incurring charges or extracting data. No public exploit code has been identified at time of analysis.
Arbitrary directory creation in browser-use web-ui 2.0.0-3.0.0 allows remote unauthenticated attackers to create directories at any path writable by the root-running container. The `run_agent_task` function passes user-supplied `save_recording_path`, `save_trace_path`, `save_agent_history_path`, and `save_download_path` values directly to filesystem operations without sanitizing absolute path inputs. Because the Gradio interface requires no authentication and containers commonly run as root, the effective write surface spans the entire container filesystem. No public exploit has been identified at time of analysis.
Cross-site scripting (XSS) vulnerability in site/search.php in OSSEC Web UI before 0.9 allows remote attackers to inject arbitrary web script or HTML by leveraging an unanchored regex. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Cross-site scripting (XSS) vulnerability in the Web UI before 2.3.4 Build #85 for Tenable Nessus 5.x allows remote web servers to inject arbitrary web script or HTML via the server header. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
The /server/properties resource in Tenable Web UI before 2.3.5 for Nessus 5.2.3 through 5.2.7 allows remote attackers to obtain sensitive information via the token parameter. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.