CVE-2024-38514 Scanner
CVE-2024-38514 Scanner - Server-Side Request Forgery vulnerability in NextChat
Used 2.3k times · 3.4k assets checked · domain, ipv4, subdomain
CVE
CVE-2024-38514
7.4
CVSShigh
Exploitable remotely over the internet · no authentication required.
Description
NextChat is a cross-platform ChatGPT/Gemini UI. There is a Server-Side Request Forgery (SSRF) vulnerability due to a lack of validation of the `endpoint` GET parameter on the WebDav API endpoint. This SSRF can be used to perform arbitrary HTTPS request from the vulnerable instance (MKCOL, PUT and GET methods supported), or to target NextChat users and make them execute arbitrary JavaScript code in their browser. This vulnerability has been patched in version 2.12.4.
Attack Vector
Network
Privileges Req.
None
User Interaction
None
chatgpt-next-webnextchat
Updated Oct 12, 2026View on NVD →
S4E scanner
CVE history: chatgpt-next-web
Predict next CVE date with AIMonitor this CVE on your assets
S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.
Create a free account →