CVE-2024-1522

A Cross-Site Request Forgery (CSRF) vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the `/execute_code` API endpoint, which does not properly validate requests, enabling an attacker to craft a malicious webpage that, when visited by a victim, submits a form to the victim's local lollms-webui instance to execute arbitrary OS commands. This issue allows attackers to take full control of the victim's system without requiring direct network access to the vulnerable application.

• CWE-352

• https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2bPatch
• https://huntr.com/bounties/687cef92-3432-4d6c-af92-868eccabbb71Exploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/parisneo/lollms-webui/commit/0b51063119cfb5e391925d232a4af1de9dc32e2bPatch
• https://huntr.com/bounties/687cef92-3432-4d6c-af92-868eccabbb71Exploit, Issue Tracking, Patch, Third Party Advisory

Published

Mar 30, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1514The WP eCommerce plugin for WordPress is vulnerable to time-…7.5
• CVE-2024-1515Rejected reason: Erroneous assignement
• CVE-2024-1516The WP eCommerce plugin for WordPress is vulnerable to unaut…5.3
• CVE-2024-1519The Paid Membership Plugin, Ecommerce, User Registration For…6.1
• CVE-2024-1520An OS Command Injection vulnerability exists in the '/open_c…9.8
• CVE-2024-1521The Elementor Website Builder Pro plugin for WordPress is vu…5.4
• CVE-2024-1523EC-WEB FS-EZViewer(Web)'s query functionality lacks proper r…8.8
• CVE-2024-1524When the "Silent Just-In-Time Provisioning" feature is enabl…8.1
• CVE-2024-1525An issue has been discovered in GitLab CE/EE affecting all v…5.3
• CVE-2024-1526The Hubbub Lite WordPress plugin before 1.33.1 does not ens…5.3
• CVE-2024-1527Unrestricted file upload vulnerability in CMS Made Simple, a…8.8
• CVE-2024-1528CMS Made Simple version 2.2.14, does not sufficiently encode…6.1