https://db.gcve.eu/sightings/feed 2026-05-20T06:02:06.342369+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent sightings. https://db.gcve.eu/sighting/e3f6dc07-00d2-40f1-8506-182b6884020c/export 2026-05-20T06:02:06.684912+00:00 cedric http://db.gcve.eu/user/cedric {"uuid": "e3f6dc07-00d2-40f1-8506-182b6884020c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "2a075640-a300-48a4-bb44-bc6130783b9b", "vulnerability": "CVE-2024-8251", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/8276", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2024-8251\n\ud83d\udd25 CVSS Score: 5.3 (cvssV3_0, Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)\n\ud83d\udd39 Description: A vulnerability in mintplex-labs/anything-llm prior to version 1.2.2 allows for Prisma injection. The issue exists in the API endpoint \"/embed/:embedId/stream-chat\" where user-provided JSON is directly taken to the Prisma library's where clause. An attacker can exploit this by providing a specially crafted JSON object, such as {\"sessionId\":{\"not\":\"a\"}}, causing Prisma to return all data from the table. This can lead to unauthorized access to all user queries in embedded chat mode.\n\ud83d\udccf Published: 2025-03-20T10:08:48.644Z\n\ud83d\udccf Modified: 2025-03-20T19:02:48.372Z\n\ud83d\udd17 References:\n1. https://huntr.com/bounties/7c263ef1-7d50-475a-9425-b15df4e0403c\n2. https://github.com/mintplex-labs/anything-llm/commit/334fd9cdd02ad4aa6a3c9bdfc95e7764651c13f4", "creation_timestamp": "2025-03-20T19:18:42.000000Z"} 2025-03-20T19:18:42+00:00