CVE-2024-2288

A Cross-Site Request Forgery (CSRF) vulnerability exists in the profile picture upload functionality of the Lollms application, specifically in the parisneo/lollms-webui repository, affecting versions up to 7.3.0. This vulnerability allows attackers to change a victim's profile picture without their consent, potentially leading to a denial of service by overloading the filesystem with files. Additionally, this flaw can be exploited to perform a stored cross-site scripting (XSS) attack, enabling attackers to execute arbitrary JavaScript in the context of the victim's browser session. The issue is resolved in version 9.3.

• CWE-352

• https://github.com/parisneo/lollms-webui/commit/ed085e6effab2b1e25ba2b00366a16ff67d8551bPatch
• https://huntr.com/bounties/2a37ae0c-890a-401a-8f3c-a261f3006290Exploit, Third Party Advisory
• https://github.com/parisneo/lollms-webui/commit/ed085e6effab2b1e25ba2b00366a16ff67d8551bPatch
• https://huntr.com/bounties/2a37ae0c-890a-401a-8f3c-a261f3006290Exploit, Third Party Advisory

Published

Jun 6, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-22862Integer overflow vulnerability in FFmpeg before n6.1, allows…9.8
• CVE-2024-2287The Knight Lab Timeline plugin for WordPress is vulnerable t…6.4
• CVE-2024-22871An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an…7.5
• CVE-2024-22873Tencent Blueking CMDB v3.2.x to v3.9.x was discovered to con…8.1
• CVE-2024-22876StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vuln…5.4
• CVE-2024-22877StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Sit…5.4
• CVE-2024-22880Cross Site Scripting vulnerability in Zadarma Zadarma extens…4.7
• CVE-2024-22889Due to incorrect access control in Plone version v6.0.9, rem…7.5
• CVE-2024-2289The PowerPack Lite for Beaver Builder plugin for WordPress i…5.4
• CVE-2024-22891Nteract v.0.28.0 was discovered to contain a remote code exe…9.8
• CVE-2024-22892OpenSlides 4.0.15 was discovered to be using a weak hashing …7.5
• CVE-2024-22893OpenSlides 4.0.15 verifies passwords by comparing password h…7.5