CVE-2024-4326

🗓️ 16 May 2024 09:03:47Reported by @huntr_aiType

cve🔗 web.nvd.nist.gov👁 51 Views🌐 WEB

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote code execution via insufficient endpoint protection, addressed in v9.

Reporter	Title	Published	Views	Family All 6
CNNVD	LoLLMs Security Vulnerabilities	16 May 202400:00	–	cnnvd
Cvelist	CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui	16 May 202409:03	–	cvelist
EUVD	EUVD-2024-43968	3 Oct 202520:07	–	euvd
NVD	CVE-2024-4326	16 May 202409:15	–	nvd
RedhatCVE	CVE-2024-4326	5 Feb 202500:18	–	redhatcve
Vulnrichment	CVE-2024-4326 Remote Code Execution via `/apply_settings` and `/execute_code` in parisneo/lollms-webui	16 May 202409:03	–	vulnrichment

NVD

Vulners

Vulnrichment

Node

lollms lollms_web_uiRange<9.5

[
  {
    "vendor": "parisneo",
    "product": "parisneo/lollms-webui",
    "versions": [
      {
        "version": "unspecified",
        "lessThan": "9.5",
        "status": "affected",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
huntr	www.huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbdd
github	www.github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905e

Parameter	Position	Path	Description	CWE
Host	header	/apply_settings	Bypass protections via localhost host header enabling code execution through settings enforcement gap.	CWE-15
code	request body	/execute_code	Execute arbitrary code remotely after settings enforcement bypass.	CWE-15

09 Jul 2025 14:29Current

9.6High risk

Vulners AI Score9.6

CVSS 39.8

EPSS0.00653

SSVC

CWE-15