CVE-2024-4326

A vulnerability in parisneo/lollms-webui versions up to 9.3 allows remote attackers to execute arbitrary code. The vulnerability stems from insufficient protection of the `/apply_settings` and `/execute_code` endpoints. Attackers can bypass protections by setting the host to localhost, enabling code execution, and disabling code validation through the `/apply_settings` endpoint. Subsequently, arbitrary commands can be executed remotely via the `/execute_code` endpoint, exploiting the delay in settings enforcement. This issue was addressed in version 9.5.

• CWE-15

• https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905ePatch
• https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbddExploit, Issue Tracking, Patch, Third Party Advisory
• https://github.com/parisneo/lollms-webui/commit/abb4c6d495a95a3ef5b114ffc57f85cd650b905ePatch
• https://huntr.com/bounties/2ab9f03d-0538-4317-be21-0748a079cbddExploit, Issue Tracking, Patch, Third Party Advisory

Published

May 16, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-43254Missing Authorization vulnerability in ZAYTECH Smart Online …8.8
• CVE-2024-43255Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2024-43256Missing Authorization vulnerability in nouthemes Leopard - W…7.1
• CVE-2024-43257Exposure of Sensitive Information to an Unauthorized Actor v…6.5
• CVE-2024-43258Exposure of Sensitive Information to an Unauthorized Actor v…7.5
• CVE-2024-43259Insertion of Sensitive Information Into Sent Data vulnerabil…7.5
• CVE-2024-43260Missing Authorization vulnerability in Creative Motion Clear…5.4
• CVE-2024-43261Improper Control of Filename for Include/Require Statement i…9.6
• CVE-2024-43262Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-43263Improper Neutralization of Input During Web Page Generation …6.5
• CVE-2024-43264Insertion of Sensitive Information Into Sent Data vulnerabil…7.5
• CVE-2024-43265Cross-Site Request Forgery (CSRF) vulnerability in Analytify…3.5