CVE-2024-11302

The CVE-2024-11302 entry concerns parisneo/lollms, specifically the lollms_binding_infos module in version V14. A missing check_access() allows an attacker to add, modify, and remove bindings via endpoints such as /install_binding and /reinstall_binding, enabling unauthorized access to binding se...

CVE-2024-11302 Missing check_access in lollms_binding_infos in parisneo/lollms

A missing checkaccess function in the lollmsbindinginfos module of the parisneo/lollms repository, version V14, allows attackers to add, modify, and remove bindings arbitrarily. This vulnerability affects the /installbinding and /reinstallbinding endpoints, among others, enabling unauthorized...

Missing check_access in lollms_binding_infos

This report is not public...

CVE-2024-6040

CVE-2024-6040 affects parisneo/lollms-webui v9.8 where lollms_binding_infos lacks the client_id parameter. The endpoints /reload_binding, /install_binding, /reinstall_binding, /unInstall_binding, /set_active_binding_settings, and /update_binding_settings are vulnerable to CSRF and local attacks, ...