{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-30T17:59:56.545","vulnerabilities":[{"cve":{"id":"CVE-2024-1646","sourceIdentifier":"security@huntr.dev","published":"2024-04-16T00:15:09.967","lastModified":"2026-06-17T07:04:41.907","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration."},{"lang":"es","value":"parisneo/lollms-webui es vulnerable a la omisión de autenticación debido a una protección insuficiente en los endpoints sensibles. La aplicación verifica si el parámetro del host no es '0.0.0.0' para restringir el acceso, lo cual es inadecuado cuando la aplicación está vinculada a una interfaz específica, lo que permite el acceso no autorizado a endpoints como '/restart_program', '/update_software', '/ check_update', '/start_recording' y '/stop_recording'. Esta vulnerabilidad puede provocar denegación de servicio, desactivación o anulación no autorizada de grabaciones y potencialmente otros impactos si ciertas funciones están habilitadas en la configuración."}],"affected":[{"source":"security@huntr.dev","affectedData":[{"vendor":"parisneo","product":"parisneo/lollms-webui","versions":[{"version":"unspecified","lessThan":"9.3","versionType":"custom","status":"affected"}]}]},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","affectedData":[{"vendor":"parisneo","product":"lollms-webui","defaultStatus":"unknown","cpes":["cpe:2.3:a:parisneo:lollms-webui:*:*:*:*:*:*:*:*"],"versions":[{"version":"*","status":"affected"}]}]}],"metrics":{"cvssMetricV30":[{"source":"security@huntr.dev","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":4.2}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2024-05-13T19:18:33.557762Z","id":"CVE-2024-1646","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security@huntr.dev","type":"Secondary","description":[{"lang":"en","value":"CWE-288"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:lollms:lollms-webui:*:*:*:*:*:*:*:*","versionEndExcluding":"9.3","matchCriteriaId":"EE0C2D4F-765C-4CF2-BC45-43D3F07D4AC3"}]}]}],"references":[{"url":"https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8","source":"security@huntr.dev","tags":["Patch"]},{"url":"https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba","source":"security@huntr.dev","tags":["Exploit","Third Party Advisory"]},{"url":"https://github.com/parisneo/lollms-webui/commit/02e829b5653a1aa5dbbe9413ec84f96caa1274e8","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"]},{"url":"https://huntr.com/bounties/2f769c46-aa85-4ab8-8b08-fe791313b7ba","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}