CVE-2024-4499

A Cross-Site Request Forgery (CSRF) vulnerability exists in the XTTS server of parisneo/lollms version 9.6 due to a lax CORS policy. The vulnerability allows attackers to perform unauthorized actions by tricking a user into visiting a malicious webpage, which can then trigger arbitrary LoLLMS-XTTS API requests. This issue can lead to the reading and writing of audio files and, when combined with other vulnerabilities, could allow for the reading of arbitrary files on the system and writing files outside the permitted audio file location.

• CWE-352

• https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65aExploit, Third Party Advisory
• https://huntr.com/bounties/336cd0eb-eb47-450d-9b2c-9332f69af65aExploit, Third Party Advisory

Published

Jun 24, 2024

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-44984In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44985In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-44986In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-44987In the Linux kernel, the following vulnerability has been re…7.8
• CVE-2024-44988In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44989In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44990In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44991In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44992In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44993In the Linux kernel, the following vulnerability has been re…7.1
• CVE-2024-44994In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-44995In the Linux kernel, the following vulnerability has been re…5.5