Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-3127 State: PUBLISHED Published: 2024-08-22T15:31:07.481Z Last Updated: 2024-08-29T15:04:57.250Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-284 Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 17.1.6, all versions starting from 17.2 before 17.2.4, all versions starting from 17.3 before 17.3.1. Under certain conditions it may be possible to bypass the IP restriction for groups through GraphQL allowing unauthorised users to perform some actions at the group level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab
perform some actions at the group level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/452640 - https://hackerone.com/reports/2395169
CVE ID: CVE-2024-3128 State: PUBLISHED Published: 2024-04-01T14:31:04.100Z Last Updated: 2024-08-01T19:32:42.850Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Replify-Messenger Problem Types: CWE-530 Description: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as problematic, has been found in Replify-Messenger 1.0 on Android. This issue affects some unknown processing of the file androidmanifest.xml of the component Backup File Handler. The manipulation leads to exposure of backup file to an unauthorized control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the publi
control sphere. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-258869 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: The vendor was contacted early and responded very quickly. He does not intend to maintain the app anymore and will revoke the availability in the Google Play Store. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258869 - https://vuldb.com/?ctiid.258869 - https://vuldb.com/?submit.307761 - https://github.com/ctflearner/Android_Findi
58869 - https://vuldb.com/?ctiid.258869 - https://vuldb.com/?submit.307761 - https://github.com/ctflearner/Android_Findings/blob/main/Replify-Messenger/Backup.md
CVE ID: CVE-2024-3129 State: PUBLISHED Published: 2024-04-01T16:00:05.695Z Last Updated: 2024-08-01T19:32:42.834Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Image Accordion Gallery App Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Image Accordion Gallery App 1.0. It has been classified as critical. This affects an unknown part of the file /endpoint/add-image.php. The manipulation of the argument image_name leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258873 was assigned to this vulnerability. Additional
been disclosed to the public and may be used. The identifier VDB-258873 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258873 - https://vuldb.com/?ctiid.258873 - https://vuldb.com/?submit.308188 - https://github.com/Sospiro014/zday1/blob/main/Image_Accordion_Gallery.md
CVE ID: CVE-2024-3130 State: PUBLISHED Published: 2024-04-01T09:13:53.082Z Last Updated: 2025-08-27T21:23:01.088Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: CoolKIt Products: eWeLink APP Problem Types: CWE-798 Description: Hard-coded Credentials in CoolKit eWeLlink app are before 5.4.x on Android and IOS allows local attacker to unauthorized access to sensitive data via Decryption algorithm and key obtained after decompiling app Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://ewelink.cc/security-advisories-and-notices/
CVE ID: CVE-2024-3131 State: PUBLISHED Published: 2024-04-01T16:31:03.488Z Last Updated: 2024-08-01T19:32:42.668Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /classes/Master.php?f=save_category. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258874 is the identifier assigned to this vulnerabili
The exploit has been disclosed to the public and may be used. VDB-258874 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258874 - https://vuldb.com/?ctiid.258874 - https://vuldb.com/?submit.308184 - https://github.com/ycxdzj/CVE_Hunter/blob/main/SQL-7.md
CVE ID: CVE-2024-3133 State: REJECTED Published: N/A Last Updated: 2024-06-07T18:17:13.918Z Description: No description available.
CVE ID: CVE-2024-3134 State: PUBLISHED Published: 2024-05-16T21:30:55.964Z Last Updated: 2024-08-01T19:32:42.852Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: litonice13 Products: Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Master Addons – Free Widgets, Hover Effects, Toggle, Conditions, Animations for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization an
via the title_html_tag attribute in all versions up to, and including, 2.0.6.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6106c972-5475-4c19-8630-3a01edc616ad?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3087193%40master-addons%2Ftrunk&old=3078134%40master-addons%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3135 State: PUBLISHED Published: 2024-04-01T18:45:07.253Z Last Updated: 2024-08-01T19:32:42.865Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: mudler Products: mudler/localai Problem Types: CWE-352 Description: A Cross-Site Request Forgery (CSRF) vulnerability exists in the mudler/localai application, allowing attackers to craft malicious webpages that, when visited by a victim, perform unauthorized actions on the victim's local LocalAI instance without their consent. This vulnerability enables attackers to exhaust system resources, consume credits, and fill disk space by making numerous resource-intensive API calls, such as generating ima
resources, consume credits, and fill disk space by making numerous resource-intensive API calls, such as generating images or uploading files. The vulnerability stems from the application's acceptance of simple request content-types without requiring CSRF tokens or implementing other CSRF mitigation measures. Successful exploitation does not require network access to the vulnerable LocalAI environment. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/7afdc4d3-4b68-45ea-96d0-cf9ed3712ae8
CVE ID: CVE-2024-3136 State: PUBLISHED Published: 2024-04-09T18:59:08.441Z Last Updated: 2024-08-08T18:22:47.089Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: stylemix Products: MasterStudy LMS WordPress Plugin – for Online Courses and Education Problem Types: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') Description: The MasterStudy LMS plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.3 via the 'template' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the exe
s makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a573740-cdfe-4b58-b33b-5e50bcbc4779?source=cve - https://plugins.trac.wordpress.org/changeset/3064337/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/templates.php - https://plugins.trac.wordpress.org
37/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/templates.php - https://plugins.trac.wordpress.org/changeset/3064337/masterstudy-lms-learning-management-system/trunk/_core/lms/classes/helpers.php
CVE ID: CVE-2024-3137 State: PUBLISHED Published: 2024-04-02T00:00:14.584Z Last Updated: 2024-09-06T16:21:28.198Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: uvdesk Products: uvdesk/community-skeleton Problem Types: CWE-269 Description: Improper Privilege Management in uvdesk/community-skeleton Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/faf74783-644c-40cd-aa98-2239e5fafcd1
CVE ID: CVE-2024-3138 State: PUBLISHED Published: 2024-04-01T22:00:05.787Z Last Updated: 2024-08-23T17:13:10.958Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: francoisjacquet Products: RosarioSIS Problem Types: CWE-79 Description: ** DISPUTED ** A vulnerability was found in francoisjacquet RosarioSIS 11.5.1. It has been rated as problematic. This issue affects some unknown processing of the component Add Portal Note. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerabil
d. The real existence of this vulnerability is still doubted at the moment. The associated identifier of this vulnerability is VDB-258911. NOTE: The vendor explains that the PDF is opened by the browser app in a sandbox, so no data from the website should be accessible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258911 - https://vuldb.com/?ctiid.258911 - https://vuldb.com/?submit.307450 - https://powerful-bulb-c36.notion.site/Stored-xss-via-malicious-PDF-upload-98fb1ea6b9bf4ddfaf04d61b2c05410a
CVE ID: CVE-2024-3139 State: PUBLISHED Published: 2024-04-01T22:31:03.827Z Last Updated: 2024-08-01T19:32:42.915Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-285 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function save_users of the file /classes/Users.php?f=save. The manipulation of the argument id leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-258914 is the identifier assigned to t
nched remotely. The exploit has been disclosed to the public and may be used. VDB-258914 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258914 - https://vuldb.com/?ctiid.258914 - https://vuldb.com/?submit.308207 - https://github.com/Sospiro014/zday1/blob/main/Laboratory_Management_System.md
CVE ID: CVE-2024-3140 State: PUBLISHED Published: 2024-04-01T23:00:04.599Z Last Updated: 2024-08-27T14:49:15.919Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in SourceCodester Computer Laboratory Management System 1.0. This affects an unknown part of the file /classes/Users.php?f=save. The manipulation of the argument middlename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is
otely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258915. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258915 - https://vuldb.com/?ctiid.258915 - https://vuldb.com/?submit.308214 - https://github.com/Sospiro014/zday1/blob/main/xss_1.md
CVE ID: CVE-2024-3141 State: PUBLISHED Published: 2024-04-01T23:00:06.054Z Last Updated: 2025-03-12T16:41:36.487Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: Clavister Products: E10, E80 Problem Types: CWE-79 Description: A vulnerability has been found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This vulnerability affects unknown code of the file /?Page=Node&OBJ=/System/AdvancedSettings/DeviceSettings/MiscSettings of the component Misc Settings Page. The manipulation of the argument WatchdogTimerTime/BufFloodRebootTime/MaxPipeUsers/AVCache Lifetime/HTTPipeliningMaxReq/Reassembly MaxConnections/Reassembly MaxProcessingMem/ScrSaveTime leads to cross
s/AVCache Lifetime/HTTPipeliningMaxReq/Reassembly MaxConnections/Reassembly MaxProcessingMem/ScrSaveTime leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-258916. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258916 - https://vuldb.com/?ctiid.258916 - https://vuldb.com/?submit.303451 - https://github.com/strik3r0x1/Vulns/blob/main/Clavister_E80-RXSS.md - https://docs.clavister.com/repo/cos-co
it.303451 - https://github.com/strik3r0x1/Vulns/blob/main/Clavister_E80-RXSS.md - https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260 - https://my.clavister.com/downloads/?sid=1
CVE ID: CVE-2024-3142 State: PUBLISHED Published: 2024-04-02T00:00:04.975Z Last Updated: 2024-08-28T13:25:28.790Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: Clavister Products: E10, E80 Problem Types: CWE-352 Description: A vulnerability was found in Clavister E10 and E80 up to 14.00.10 and classified as problematic. This issue affects some unknown processing of the component Setting Handler. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-2
ersion 14.00.11 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-258917 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258917 - https://vuldb.com/?ctiid.258917 - https://vuldb.com/?submit.303530 - https://github.com/strik3r0x1/Vulns/blob/main/CSRF_Clavister-E80,E10.md - https://docs.clavister.com/repo/cos-core-release-notes/doc/index.html#d0e2260 - https://my.clavister.com/downloads/?sid=1
CVE ID: CVE-2024-3143 State: PUBLISHED Published: 2024-04-02T00:00:06.507Z Last Updated: 2024-08-01T20:05:07.014Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7. It has been classified as problematic. Affected is an unknown function of the file /src/dede/member_rank.php. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-258918 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Add
ed to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258918 - https://vuldb.com/?ctiid.258918 - https://vuldb.com/?submit.303432 - https://github.com/E1CHO/demo/blob/main/39.pdf
CVE ID: CVE-2024-3144 State: PUBLISHED Published: 2024-04-02T01:00:04.567Z Last Updated: 2024-08-01T20:05:07.744Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /src/dede/makehtml_spec.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258919. NOTE: The vendor was contacted early about this disclosure but did not res
entifier of this vulnerability is VDB-258919. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258919 - https://vuldb.com/?ctiid.258919 - https://vuldb.com/?submit.303954 - https://github.com/Hckwzh/cms/blob/main/12.md
CVE ID: CVE-2024-3145 State: PUBLISHED Published: 2024-04-02T01:00:05.994Z Last Updated: 2024-08-01T20:05:07.537Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability was found in DedeCMS 5.7. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /src/dede/makehtml_js_action.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258920. NOTE: The vendor was contacted early about this disclosure but did not respond in any way
s vulnerability is VDB-258920. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258920 - https://vuldb.com/?ctiid.258920 - https://vuldb.com/?submit.303955 - https://github.com/Hckwzh/cms/blob/main/13.md
CVE ID: CVE-2024-3146 State: PUBLISHED Published: 2024-04-02T01:31:03.976Z Last Updated: 2024-08-01T20:05:07.637Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability classified as problematic has been found in DedeCMS 5.7. This affects an unknown part of the file /src/dede/makehtml_rss_action.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-258921 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Add
ed to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258921 - https://vuldb.com/?ctiid.258921 - https://vuldb.com/?submit.303956 - https://github.com/Hckwzh/cms/blob/main/14.md
CVE ID: CVE-2024-3147 State: PUBLISHED Published: 2024-04-02T01:31:05.308Z Last Updated: 2024-08-01T20:05:07.564Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: n/a Products: DedeCMS Problem Types: CWE-352 Description: A vulnerability classified as problematic was found in DedeCMS 5.7. This vulnerability affects unknown code of the file /src/dede/makehtml_map.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-258922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Anal
ulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.258922 - https://vuldb.com/?ctiid.258922 - https://vuldb.com/?submit.303957 - https://github.com/Hckwzh/cms/blob/main/15.md
CVE ID: CVE-2024-3148 State: PUBLISHED Published: 2024-04-02T02:00:05.666Z Last Updated: 2024-08-12T18:00:33.635Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: DedeCMS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in DedeCMS 5.7.112. This issue affects some unknown processing of the file dede/makehtml_archives_action.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any wa
is vulnerability is VDB-258923. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258923 - https://vuldb.com/?ctiid.258923 - https://vuldb.com/?submit.303889 - https://github.com/gatsby2003/DedeCms/blob/main/DedeCms%20sql%20time-based%20blind%20injection.md
CVE ID: CVE-2024-3149 State: PUBLISHED Published: 2024-06-06T18:43:50.967Z Last Updated: 2024-08-01T20:05:07.017Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: mintplex-labs Products: mintplex-labs/anything-llm Problem Types: CWE-918 Description: A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm. This feature, intended for users with manager or admin roles, processes uploaded links through an internal Collector API using a headless browser. An attacker can exploit this by hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web appli
hosting a malicious website and using it to perform actions such as internal port scanning, accessing internal web applications not exposed externally, and interacting with the Collector API. This interaction can lead to unauthorized actions such as arbitrary file deletion and limited Local File Inclusion (LFI), including accessing NGINX access logs which may contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/b230d76b-ae2d-440e-a25b-94ffaa7c4ff1 - https://github.com/mintplex-labs/anything-llm/commit/f4088d9348fa86dcebe9f97a18d39c0a6e92f15e