Lollms Webui
Approved changes feed: RSS · Atom
cpe:2.3:a:lollms:lollms-webui:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Lollms (c462c41a-51fb-579f-8ef2-5b37366b074d) |
|---|---|
| Product | Lollms Webui (b2a1cced-948c-5799-bcda-7edd409fa278) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/parisneo/lollms-webui |
purl2cpe | 2026-06-01 10:17:49.447215 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-1646 |
vulnerable | 2026-06-08 06:27:13.971343 |
Authentication Bypass in parisneo/lollms-webui
HIGH (8.2)
parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive endpoints. The application checks if the host parameter is not '0.0.0.0' to restrict access, which is inadequate when the application is bound to a specific interface, allowing unauthorized access to endpoints such as '/restart_program', '/update_software', '/check_update', '/start_recording', and '/stop_recording'. This vulnerability can lead to denial of service, unauthorized disabling or overriding of recordings, and potentially other impacts if certain features are enabled in the configuration.
Published: 2024-04-16T00:00:14.201Z
Updated: 2024-08-01T18:48:20.668Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.