CVE-2024-12766

parisneo/lollms-webui version V13 (feather) suffers from a Server-Side Request Forgery (SSRF) vulnerability in the `POST /api/proxy` REST API. Attackers can exploit this vulnerability to abuse the victim server's credentials to access unauthorized web resources by specifying the JSON parameter `{"url":"http://steal.target"}`. Existing security mechanisms such as `forbid_remote_access(lollmsElfServer)`, `lollmsElfServer.config.headless_server_mode`, and `check_access(lollmsElfServer, request.client_id)` do not protect against this vulnerability.

• CWE-918

• https://huntr.com/bounties/a143a2e2-1293-4dec-b875-3312584bd2b1Exploit, Third Party Advisory
• https://huntr.com/bounties/a143a2e2-1293-4dec-b875-3312584bd2b1Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-12760Rejected reason: ** REJECT ** DO NOT USE THIS CVE ID NUMBER.…
• CVE-2024-12761A Denial of Service (DoS) vulnerability exists in the bryced…7.5
• CVE-2024-12762Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-12763Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-12764Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-12765Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-12767The buddyboss-platform WordPress plugin before 2.7.60 lacks …3.5
• CVE-2024-12768The Responsive iframe WordPress plugin through 1.2.0 does no…5.4
• CVE-2024-12769The Simple Banner WordPress plugin before 3.0.4 does not sa…3.5
• CVE-2024-1277The Ocean Extra plugin for WordPress is vulnerable to Stored…5.4
• CVE-2024-12770The WP ULike WordPress plugin before 4.7.6 does not sanitis…4.8
• CVE-2024-12771The eCommerce Product Catalog Plugin for WordPress plugin fo…8.8