Flowise versions prior to 1.6.6 are vulnerable to an authentication bypass allowing a remote and unauthenticated attacker to perform administrative actions through the REST API.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Flowise instance on the target application. Flowise is a builder for LLM applications. This detection is included in the AI and LLM category.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible LibreChat instance on the target application. LibreChat is an enhanced open-source ChatGPT clone. This detection is included in the AI and LLM category.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible NextChat (formerly ChatGPT-Next-Web) instance on the target application. NextChat is a collection of tools to help developers build their own AI service around most popular LLMs. This detection is included in the AI and LLM category.

NextChat (formerly ChatGPT-Next-Web) versions prior to 2.11.3 are vulnerable to Server-Side Request Forgery (SSRF) and Cross-Site Scripting attacks, allowing remote and unauthenticated attacker to make the vulnerable instance issue arbitrary requests on both external or internal assets through the '/api/cors' endpoint or to execute JavaScript in the application users browsers context.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Quivr instance on the target application. Quivr is RAG Framework specialized for building GenAI Second Brains and allows discussion with a variety of documents using different LLM models. This detection is included in the AI and LLM category.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible Open WebUI instance on the target application. Open WebUI offer an extensible web application designed for various LLM while offering a feature-rich environment. This detection is included in the AI and LLM category.

This is an informational plugin to inform the user that the scanner has detected a publicly accessible AnythingLLM instance on the target application. AnythingLLM let you choose between different LLM or vector database to use and allow to convert any document or content into references that the selected language model can use while chatting. This detection is included in the AI and LLM category.

ID	Name	Severity
114312	Flowise < 1.6.6 Authentication Bypass	high
114309	Flowise Detected	info
114308	LibreChat Detected	info
114307	NextChat Detected	info
114306	NextChat < 2.11.3 Server-Side Request Forgery	critical
114305	Quivr Detected	info
114304	Open WebUI Detected	info
114303	AnythingLLM Detected	info

Detections

Analytics

Artificial Intelligence Family for Web App Scanning

high

info

info

info

critical

info

info

info