S4E just found a high-severity finding from top 10 tcp port service scan

CVE

CVE-2024-6842

7.5

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

In version 1.5.5 of mintplex-labs/anything-llm, the `/setup-complete` API endpoint allows unauthorized users to access sensitive system settings. The data returned by the `currentSettings` function includes sensitive information such as API keys for search engines, which can be exploited by attackers to steal these keys and cause loss of user assets.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

mintplex-labs/anything-llm

Updated Sep 18, 2026View on NVD →

S4E scanner

highProduct Based Web Vulnerabilities~10 seconds

CVE-2024-6842 Scanner

CVE-2024-6842 scanner - Information Disclosure vulnerability in AnythingLLM

Used 3.3k times · 5.9k assets checked · url

Scanner page →Run scanner

CVE history: mintplex-labs/anything-llm

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →