Anythingllm Docker

2 CVEs product

Monthly

Sort: Newest CVSS Score EPSS Score Oldest

CVE-2024-13060 Mar 20, 10:15 MEDIUM POC PATCH This Month

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

Authentication Bypass Docker Anythingllm Docker Mintplexlabs

NVD GitHub

CVSS 3.1

4.3

EPSS

0.1%

CVE-2024-3166 Jun 06, 19:16 CRITICAL POC PATCH Act Now

A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

XSS RCE Anythingllm Docker Anythingllm Desktop Mintplexlabs

NVD GitHub

CVSS 3.1

9.6

EPSS

1.0%

CVE-2024-13060

EPSS 0% CVSS 4.3

MEDIUM POC PATCH This Month

Authentication Bypass Docker Anythingllm Docker +1

NVD GitHub

CVE-2024-3166

EPSS 1% CVSS 9.6

CRITICAL POC PATCH Act Now

XSS RCE Anythingllm Docker +2

NVD GitHub