AlphabugX/CVE-2025-64495-POC

PoC

Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE

view exploit source poc_in_githubauthor AlphabugXpublished 2025-11-10catalog poc_in_github

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2025-64495US	medium5.4	0.49% (42nd)	Exploit	2025-11-08
Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. In versions 0.6.34 and below, the functionality that inserts custom prompts into…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.