CVE Feed

    Dashboard / CVE / CVE-2024-4403

    CVE-2024-4403

    A Cross-Site Request Forgery (CSRF) vulnerability exists in the restart_program function of the parisneo/lollms-webui v9.6. This vulnerability allows attackers to trick users into performing unintended actions, such as resetting the program without their knowledge, by sending specially crafted CSRF forms. This issue affects the installation process, including the installation of Binding zoo and Models zoo, by unexpectedly resetting programs. The vulnerability is due to the lack of CSRF protection in the affected function.

    Published:Jun 10, 2024
    Last Modified:Aug 15, 2025
    EPS:Jun 10, 2024
    EPSS Score:0.00055
    CVSS Score:8.8

    Affected Products

    Vendor
    Lollms
    Product
    Lollms-webui
    Vendor
    Parisneo
    Product
    Lollms-webui

    Exploits

    https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851https://huntr.com/bounties/c9dd6d2f-d83a-488b-9443-d4200c010851

    Related CVEs

    CVE-2024-5125 (CVSS 7.3) — parisneo/lollms-webui version 9.6 is vulnerable to Cross-Site Scripting (XSS) and Open Redirect due to inadequ…
    CVE-2024-6971 (CVSS 4.4) — A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the `lollms_fil…
    CVE-2024-4839 (CVSS 3.3) — A Cross-Site Request Forgery (CSRF) vulnerability exists in the 'Servers Configurations' function of the paris…
    CVE-2024-4841 (CVSS 3.3) — A Path Traversal vulnerability exists in the parisneo/lollms-webui, specifically within the 'add_reference_to_…
    CVE-2024-4267 (CVSS 9.8) — A remote code execution (RCE) vulnerability exists in the parisneo/lollms-webui, specifically within the 'open…
    CVE-2024-1569 (CVSS 7.5) — parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumpti…
    CVE-2024-1601 (CVSS 9.8) — An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui appli…
    CVE-2024-1646 (CVSS 8.2) — parisneo/lollms-webui is vulnerable to authentication bypass due to insufficient protection over sensitive end…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High