CVE-2024-13060

PoC —

CVSS 3.1

4.3 medium

EPSS

<1%p40

Published

Mar 20, 2025 (Mar 20, 2025)

Modified

Jun 17, 2026

Description

A vulnerability in AnythingLLM Docker version 1.3.1 allows users with 'Default' permission to access other users' profile pictures by changing the 'id' parameter in the user cookie. This issue is present in versions prior to 1.3.1.

Vendors: mintplexlabs
Products: anythingllm docker
Weakness: CWE-862
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.