CVE Feed

    Dashboard / CVE / CVE-2024-12374

    CVE-2024-12374

    A stored cross-site scripting (XSS) vulnerability exists in automatic1111/stable-diffusion-webui version git 82a973c. An attacker can upload an HTML file, which the application interprets as content-type application/html. If a victim accesses the malicious link, it will execute arbitrary JavaScript in the victim's browser.

    Published:Mar 20, 2025
    Last Modified:Oct 30, 2025
    EPS:Mar 20, 2025
    EPSS Score:0.00034
    CVSS Score:6.1

    Affected Products

    Vendor
    Automatic1111
    Product
    Stable-diffusion-webui

    Exploits

    https://huntr.com/bounties/3dae386a-f442-4be6-87ef-956606c8a6ac

    Related CVEs

    CVE-2026-82288 (CVSS 8.7) — Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flag…
    CVE-2024-12375 (CVSS 6.5) — A local file inclusion vulnerability was identified in automatic1111/stable-diffusion-webui, affecting version…
    CVE-2024-10935 (CVSS 7.5) — automatic1111/stable-diffusion-webui version 1.10.0 contains a vulnerability where the server fails to handle …
    CVE-2024-12074 (CVSS 6.5) — A Denial of Service (DoS) vulnerability was discovered in the file upload feature of automatic1111/stable-diff…
    CVE-2024-11045 (CVSS 9.6) — A Cross-Site WebSocket Hijacking (CSWSH) vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 …
    CVE-2024-11044 (CVSS 6.1) — An open redirect vulnerability in automatic1111/stable-diffusion-webui version 1.10.0 allows a remote unauthen…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High