CVE Feed

    Dashboard / CVE / CVE-2024-1569

    CVE-2024-1569

    parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.

    Published:Apr 15, 2024
    Last Modified:Jul 7, 2025
    EPS:Apr 16, 2024
    EPSS Score:0.00122
    CVSS Score:7.5

    Affected Products

    Vendor
    Lollms
    Product
    Lollms-webui

    Exploits

    https://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148ehttps://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148e

    Related CVEs

    CVE-2024-5125 (CVSS 7.3) — parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequ…
    CVE-2024-6971 (CVSS 4.4) — A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_fil…
    CVE-2024-4839 (CVSS 3.3) — A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the paris…
    CVE-2024-4841 (CVSS 3.3) — A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_…
    CVE-2024-4403 (CVSS 8.8) — A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollm…
    CVE-2024-4267 (CVSS 9.8) — A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open…
    CVE-2024-1601 (CVSS 9.8) — An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui appli…
    CVE-2024-1646 (CVSS 8.2) — parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive end…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High