CVE-2024-1569

parisneo/lollms-webui is vulnerable to a denial of service (DoS) attack due to uncontrolled resource consumption. Attackers can exploit the `/open_code_in_vs_code` and similar endpoints without authentication by sending repeated HTTP POST requests, leading to the opening of Visual Studio Code or the default folder opener (e.g., File Explorer, xdg-open) multiple times. This can render the host machine unusable by exhausting system resources. The vulnerability is present in the latest version of the software.

• CWE-400

• https://github.com/parisneo/lollms-webui/commit/354cf766835396b7fc0d5105ed3b77572a653149Patch
• https://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148eExploit, Third Party Advisory
• https://github.com/parisneo/lollms-webui/commit/354cf766835396b7fc0d5105ed3b77572a653149Patch
• https://huntr.com/bounties/369d1694-47e4-49bc-bb35-931ce4a5148eExploit, Third Party Advisory

Published

Apr 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-1563An attacker could have executed unauthorized scripts on top …8.1
• CVE-2024-1564The wp-schema-pro WordPress plugin before 2.7.16 does not va…4.3
• CVE-2024-1565The EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wis…5.4
• CVE-2024-1566The Redirects plugin for WordPress is vulnerable to unauthor…6.5
• CVE-2024-1567The Royal Elementor Addons and Templates plugin for WordPres…9.8
• CVE-2024-1568The Seraphinite Accelerator plugin for WordPress is vulnerab…6.4
• CVE-2024-1570The Paid Membership Plugin, Ecommerce, User Registration For…5.4
• CVE-2024-1571The WP Recipe Maker plugin for WordPress is vulnerable to St…4.8
• CVE-2024-1572The WP ULike plugin for WordPress is vulnerable to Stored Cr…5.4
• CVE-2024-1573Missing Authentication for Critical Function vulnerability i…5.9
• CVE-2024-1574Use of Externally-Controlled Input to Select Classes or Code…6.7
• CVE-2024-1575The improper privilege management vulnerability in the Zyxel…6.5