CVE-2026-47671

Nhost CLI prior to 1.46.0 exposes an unauthenticated, cross-origin-configurable configserver via nhost dev. The hidden configserver serves Mimir GraphQL with dummy authorization and permissive CORS (Access-Control-Allow-Origin: *). An attacker-controlled web page can reach localhost and perform q...

NetEase QAnything 安全漏洞

NetEase QAnything is a local knowledge base question and answer system dedicated to supporting arbitrary format files or databases from China's NetEase NetEase, which can be installed and used offline. A security vulnerability exists in NetEase QAnything, which stems from a cross-site request...

CVE-2024-4499

A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS...

PT-2024-31349 · Lollms +1 · Lollms +2

Name of the Vulnerable Software and Affected Versions: lollms version 9.6 Description: A Cross-Site Request Forgery CSRF vulnerability exists in the XTTS server due to a lax CORS policy, allowing attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage. This...

LoLLMs Cross-Site Request Forgery Vulnerability

LoLLMs is a Web UI for a large language multimodal system by the individual developer Saifeddine ALOUI. A cross-site request forgery vulnerability exists in LoLLMs version 9.6 that stems from a lax CORS policy. An attacker could use this vulnerability to read arbitrary files on the system and wri...