THREATIST.IORead the docs No mintplex-labs vulnerabilities are listed in CISA KEV.
78 records
In mintplex-labs/anything-llm v1.5.11 desktop version for Windows, the application opens server port 3001 on 0.0.0.0 with no authentication by default.
An improper authorization vulnerability exists in the mintplex-labs/anything-llm application, specifically within the '/api/v/' endpoint and its sub-routes.
An improper access control vulnerability exists in the mintplex-labs/anything-llm application, specifically within the import endpoint.
Improper Input Validation in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
A remote code execution vulnerability exists in mintplex-labs/anything-llm due to improper handling of environment variables.
mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality.
Relative Path Traversal in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
A Cross-Site Scripting (XSS) vulnerability exists in mintplex-labs/anything-llm, affecting both the desktop application version 1.2.0 and the latest version of the web application.
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.
mintplex-labs/anything-llm is vulnerable to multiple security issues due to improper input validation in several endpoints.
In mintplex-labs/anything-llm, a vulnerability exists in the thread update process that allows users with Default or Manager roles to escalate their privileges to Administrator.
A Server-Side Request Forgery (SSRF) vulnerability exists in the upload link feature of mintplex-labs/anything-llm.
Improper Access Control in GitHub repository mintplex-labs/anything-llm prior to 0.1.0.
SQL Injection in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
AnythingLLM is an application that turns any document, resource, or piece of content into context that any LLM can use as references during chatting.
mintplex-labs/anything-llm version git 6dc3642 contains an unauthenticated Denial of Service (DoS) vulnerability in the API for the embeddable chat functionality.
In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings.
A vulnerability in mintplex-labs/anything-llm allows for a Denial of Service (DoS) condition due to uncontrolled resource consumption.
Authentication Bypass by Primary Weakness in GitHub repository mintplex-labs/anything-llm prior to 0.0.1.
A stored Cross-Site Scripting (XSS) vulnerability exists in the mintplex-labs/anything-llm application, affecting versions up to and including the latest before 1.0.0.
As a manager, you should not be able to modify a series of settings.
In mintplex-labs/anything-llm, an attacker can exploit improper input validation by sending a malformed JSON payload to the '/system/enable-multi-user' endpoint.
A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models".
AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting.