CVE-2024-9597

A Path Traversal vulnerability exists in the `/wipe_database` endpoint of parisneo/lollms version v12, allowing an attacker to delete any directory on the system. The vulnerability arises from improper validation of the `key` parameter, which is used to construct file paths. An attacker can exploit this by sending a specially crafted HTTP request to delete arbitrary directories.

• CWE-22

• https://huntr.com/bounties/1f6c8908-d486-4141-be55-25bd29933d8b

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-9591The Category and Taxonomy Image plugin for WordPress is vuln…4.8
• CVE-2024-9592The Easy PayPal Gift Certificate plugin for WordPress is vul…6.1
• CVE-2024-9593The Time Clock plugin and Time Clock Pro plugin for WordPres…8.3
• CVE-2024-9594A security issue was discovered in the Kubernetes Image Buil…8.1
• CVE-2024-9595The TablePress – Tables in WordPress made easy plugin for Wo…5.4
• CVE-2024-9596An issue has been discovered in GitLab EE affecting all vers…5.3
• CVE-2024-9598The AMP for WP – Accelerated Mobile Pages plugin for WordPre…8.8
• CVE-2024-9599The Popup Box WordPress plugin before 4.7.8 does not saniti…5.4
• CVE-2024-9600The Ditty WordPress plugin before 3.1.47 does not sanitise …4.8
• CVE-2024-9601The Qubely – Advanced Gutenberg Blocks plugin for WordPress …5.4
• CVE-2024-9602Type Confusion in V8 in Google Chrome prior to 129.0.6668.10…8.8
• CVE-2024-9603Type Confusion in V8 in Google Chrome prior to 129.0.6668.10…8.8