CVE-2024-0759

Should an instance of AnythingLLM be hosted on an internal network and the attacked be explicitly granted a permission level of manager or admin, they could link-scrape internally resolving IPs of other services that are on the same network as AnythingLLM. This would require the attacker also be...

Changing the "ID" parameter in the user cookie allows loading the profile picture of other users

Description A vulnerability has been discovered in AnythingLLM Docker that allows users, even with "Default" permission, to obtain other users' profile pictures. Proof of Concept 1 Create a new user with the default role; 2 Log in to the user account you created; 3 Open the browser inspector and...

AnythingLLM Information Disclosure Vulnerability

AnythingLLM is a chatbot application that supports building using commercial or open source big language models combined with a private knowledge base. An information disclosure vulnerability exists in AnythingLLM, which can be exploited to obtain an API key from a process environment variable...

AnythingLLM 安全漏洞

AnythingLLM is an all-in-one AI application open-sourced by Mintplex. A security vulnerability exists in versions of AnythingLLM prior to 1.0.3, which stems from sensitive information being incorrectly stored in a JWT used as a token bearer in single-user mode, which when decoded displays the...

AnythingLLM API Sensitive Information Disclosure

AnythingLLM suffers from an information disclosure vulnerability through the /api/setup-complete API endpoint. By accessing this endpoint, a remote and unauthenticated attacker can access sensitive configuration of the target AnythingLLM instance. This detection is included in the AI and LLM...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from the application's failure to limit the size of usernames, which can lead to a denial of service DoS condition due to uncontrolled resource consumption...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in Mintplex Labs AnythingLLM versions 1.5.3 and earlier, which stems from the fact that the entire User object including the bcrypt password hash is included in the response sent to the front-end, ...

AnythingLLM Detected

This is an informational plugin to inform the user that the scanner has detected a publicly accessible AnythingLLM instance on the target application. AnythingLLM let you choose between different LLM or vector database to use and allow to convert any document or content into references that the...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a security vulnerability that stems from an uncontrolled resource consumption vulnerability that allows an attacker to shut down the server by sending invalid upload requests, resulting in a denial of service DOS...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has a security vulnerability that stems from the presence of a path traversal vulnerability that could lead to a denial of service DoS attack and unauthorized administrator account takeover...

AnythingLLM Cross-Site Scripting Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from a cross-site scripting vulnerability that stems from the presence of a stored cross-site scripting XSS vulnerability...

AnythingLLM Operating System Command Injection Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from an operating system command injection vulnerability that stems from improper handling of environment variables, leading to remote code execution...

AnythingLLM Security Vulnerability

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that originates from the possibility of brute-force decompression...

AnythingLLM Authorization Issues Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM has an authorization issue vulnerability that stems from the presence of an improper authorization vulnerability...

AnythingLLM Resource Management Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. AnythingLLM suffers from a resource management error vulnerability that stems from a denial of service that can be caused by uploading a large number of invalid files...

AnythingLLM Input Validation Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. An input validation error vulnerability exists in AnythingLLM that stems from the application failing to properly validate user input before passing it to prisma functions and other critical operations...

AnythingLLM Code Issue Vulnerability

AnythingLLM is a business-compliant document chatbot. AnythingLLM has a code issue vulnerability that stems from a server-side request forgery SSRF vulnerability in the upload link feature...

AnythingLLM Input Validation Error Vulnerability

AnythingLLM is a document chatbot that meets business requirements. An input validation error vulnerability exists in AnythingLLM that stems from the application failing to validate or check user input before passing it to the Prisma model for execution...

AnythingLLM Cross-Site Scripting Vulnerability

AnythingLLM is a business-compliant document chatbot. A cross-site scripting vulnerability exists in AnythingLLM that stems from the application's ability to fetch content from a website and embed it in the workspace, which can be exploited to execute arbitrary JavaScript code...

AnythingLLM 安全漏洞

AnythingLLM is a document chatbot that meets business requirements. A security vulnerability exists in AnythingLLM that stems from vulnerability to improper neutralization in the use of special elements in expression language statements, allowing all existing attributes of a database entity to be...