Lucene search

K

Chat Security Vulnerabilities

cve
cve

CVE-2023-23727

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Formilla Live Chat by Formilla plugin <= 1.3...

5.9CVSS

4.9AI Score

0.0005EPSS

2023-05-16 09:15 AM
12
cve
cve

CVE-2022-46817

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flyzoo Flyzoo Chat plugin <= 2.3.3...

5.9CVSS

4.9AI Score

0.0005EPSS

2023-05-10 10:15 AM
15
cve
cve

CVE-2023-23734

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in David Voswinkel Userlike – WordPress Live Chat plugin <= 2.2...

5.9CVSS

4.8AI Score

0.0005EPSS

2023-05-09 11:15 AM
16
cve
cve

CVE-2023-25710

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in DIGITALBLUE Click to Call or Chat Buttons plugin <= 1.4.0...

5.9CVSS

4.8AI Score

0.0005EPSS

2023-04-25 12:15 PM
11
cve
cve

CVE-2023-1020

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL...

9.8CVSS

9.8AI Score

0.053EPSS

2023-04-24 07:15 PM
35
cve
cve

CVE-2023-0899

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as...

6.1CVSS

5.9AI Score

0.001EPSS

2023-04-24 07:15 PM
25
cve
cve

CVE-2023-0487

The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as...

7.2CVSS

7.2AI Score

0.001EPSS

2023-02-27 04:15 PM
25
cve
cve

CVE-2022-48306

Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept,....

6.8CVSS

6.3AI Score

0.001EPSS

2023-02-16 04:15 PM
15
cve
cve

CVE-2022-4902

A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible...

6.1CVSS

6.1AI Score

0.001EPSS

2023-02-06 07:15 PM
19
cve
cve

CVE-2022-4760

The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

5.4CVSS

5.3AI Score

0.001EPSS

2023-01-23 03:15 PM
36
cve
cve

CVE-2022-4480

The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

5.4CVSS

5.3AI Score

0.001EPSS

2023-01-16 04:15 PM
45
cve
cve

CVE-2022-44939

Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted...

7.8CVSS

7.9AI Score

0.001EPSS

2023-01-06 10:15 PM
22
cve
cve

CVE-2020-36625

A vulnerability was found in destiny.gg chat. It has been rated as problematic. This issue affects the function websocket.Upgrader of the file main.go. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The name of the patch is...

8.8CVSS

8.7AI Score

0.001EPSS

2022-12-22 10:15 AM
28
cve
cve

CVE-2022-3858

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as...

7.2CVSS

7.2AI Score

0.001EPSS

2022-12-05 05:15 PM
35
cve
cve

CVE-2022-3415

The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cross-Site Scripting payloads in them, which will trigger when an admin view the related contact...

6.1CVSS

5.8AI Score

0.001EPSS

2022-11-14 03:15 PM
32
3
cve
cve

CVE-2022-45195

SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy and can have other impacts if there is a compromise of a single private key. This occurs in the X3DH key exchange for the double ratchet...

5.3CVSS

5.2AI Score

0.001EPSS

2022-11-12 07:15 PM
31
16
cve
cve

CVE-2022-3391

The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite...

4.8CVSS

4.7AI Score

0.001EPSS

2022-10-25 05:15 PM
31
5
cve
cve

CVE-2022-39279

discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing staff members to cause an cross site scripting (XSS) attack by inserting unsafe HTML into them....

5.4CVSS

5.2AI Score

0.001EPSS

2022-10-06 08:15 PM
17
4
cve
cve

CVE-2017-9557

register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1 allows remote attackers to discover passwords by sending the username parameter in conjunction with an empty password parameter, and reading the HTML source code of the...

7.5CVSS

7.7AI Score

0.006EPSS

2022-10-03 04:23 PM
21
cve
cve

CVE-2018-12534

A SQL injection issue was discovered in the Quick Chat plugin before 4.00 for...

9.8CVSS

9.8AI Score

0.001EPSS

2022-10-03 04:22 PM
23
cve
cve

CVE-2018-20524

The Chat Anywhere extension 2.4.0 for Chrome allows XSS via crafted use of < in a message, because a danmuWrapper DIV element in chatbox-only\danmu.js is outside the scope of a Content Security Policy...

6.1CVSS

5.9AI Score

0.001EPSS

2022-10-03 04:22 PM
21
cve
cve

CVE-2015-8601

The Chat Room module 7.x-2.x before 7.x-2.2 for Drupal does not properly check permissions when setting up a websocket for chat messages, which allows remote attackers to bypass intended access restrictions and read messages from arbitrary Chat Rooms via unspecified...

7AI Score

0.002EPSS

2022-10-03 04:15 PM
16
cve
cve

CVE-2012-6047

Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user to an arbitrary group via the users page in an adminpanel action to...

7.4AI Score

0.002EPSS

2022-10-03 04:15 PM
19
cve
cve

CVE-2011-2181

Multiple SQL injection vulnerabilities in A Really Simple Chat (ARSC) 3.3-rc2 allow remote attackers to execute arbitrary SQL commands via the (1) arsc_user parameter to base/admin/edit_user.php, (2) arsc_layout_id parameter in base/admin/edit_layout.php, or (3) arsc_room parameter to...

8.7AI Score

0.002EPSS

2022-10-03 04:15 PM
26
cve
cve

CVE-2011-2180

Cross-site scripting (XSS) vulnerability in dereferer.php in A Really Simple Chat (ARSC) 3.3-rc2 allows remote attackers to inject arbitrary web script or HTML via the arsc_link...

5.8AI Score

0.004EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2011-2470

Cross-site scripting (XSS) vulnerability in chat/base/admin/login.php in A Really Simple Chat (ARSC) 3.3-rc2 allows remote attackers to inject arbitrary web script or HTML via the arsc_message...

5.8AI Score

0.005EPSS

2022-10-03 04:15 PM
18
cve
cve

CVE-2011-5297

Multiple cross-site scripting (XSS) vulnerabilities in TTChat 1.0.4 allow remote attackers to inject arbitrary web script or HTML via (1) the msg parameter to default.php or (2) the username parameter to...

5.9AI Score

0.001EPSS

2022-10-03 04:15 PM
25
cve
cve

CVE-2011-5296

Cross-site scripting (XSS) vulnerability in profilo.php in Happy Chat 1.0 allows remote attackers to inject arbitrary web script or HTML via the nick...

5.9AI Score

0.001EPSS

2022-10-03 04:15 PM
24
cve
cve

CVE-2013-0318

The admin page in the Banckle Chat module for Drupal does not properly restrict access, which allows remote attackers to bypass intended restrictions via unspecified...

6.9AI Score

0.004EPSS

2022-10-03 04:15 PM
29
cve
cve

CVE-2022-36057

Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users inserting HTML into chat titles and descriptions, causing a Cross-Site Scripting (XSS) attack. Version 0.9 contains a patch for this...

5.4CVSS

4.9AI Score

0.001EPSS

2022-09-06 08:15 PM
26
2
cve
cve

CVE-2022-2361

The WP Social Chat WordPress plugin before 6.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting...

4.8CVSS

4.7AI Score

0.001EPSS

2022-08-22 03:15 PM
35
4
cve
cve

CVE-2022-2375

The WP Sticky Button WordPress plugin before 1.4.1 does not have authorisation and CSRF checks when saving its settings, allowing unauthenticated users to update them. Furthermore, due to the lack of escaping in some of them, it could lead to Stored Cross-Site Scripting...

5.4CVSS

5.4AI Score

0.001EPSS

2022-08-22 03:15 PM
36
5
cve
cve

CVE-2022-2039

The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This makes it possible for unauthenticated...

8.8CVSS

8.4AI Score

0.002EPSS

2022-07-18 05:15 PM
44
2
cve
cve

CVE-2022-31095

discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker who knows the message ID for a channel they do not have access to can view that message using the chat message lookup endpoint, primarily...

6.5CVSS

6.4AI Score

0.001EPSS

2022-06-21 07:15 PM
28
7
cve
cve

CVE-2022-31013

Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token, resulting in authentication bypass. The function this.authProvider.verifyAccessKey is an async function, as the code is not using await to....

9.8CVSS

9.6AI Score

0.002EPSS

2022-05-31 11:15 PM
46
3
cve
cve

CVE-2022-0642

The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject...

5.4CVSS

5.3AI Score

0.001EPSS

2022-05-30 09:15 AM
56
5
cve
cve

CVE-2022-20802

A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface. This vulnerability is due to insufficient validation of user-supplied input that is processed.....

5.4CVSS

5.4AI Score

0.001EPSS

2022-05-27 02:15 PM
120
5
cve
cve

CVE-2022-1239

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF...

8.8CVSS

8.6AI Score

0.001EPSS

2022-05-02 04:15 PM
77
4
cve
cve

CVE-2022-1530

Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the...

6.1CVSS

6AI Score

0.001EPSS

2022-04-29 09:15 AM
71
cve
cve

CVE-2022-27849

Sensitive Information Disclosure (sac-export.csv) in Simple Ajax Chat (WordPress plugin) <=...

7.5CVSS

7.3AI Score

0.005EPSS

2022-04-15 05:15 PM
63
cve
cve

CVE-2022-27850

Cross-Site Request Forgery (CSRF) in Simple Ajax Chat (WordPress plugin) <= 20220115 allows an attacker to clear the chat log or delete a chat...

5.4CVSS

4.6AI Score

0.001EPSS

2022-04-15 05:15 PM
56
cve
cve

CVE-2022-0935

Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to...

8.8CVSS

8.9AI Score

0.002EPSS

2022-04-07 07:15 PM
57
cve
cve

CVE-2022-1234

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s...

6.1CVSS

6.1AI Score

0.001EPSS

2022-04-06 04:15 AM
70
cve
cve

CVE-2022-1235

Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to...

8.2CVSS

8.1AI Score

0.001EPSS

2022-04-05 07:15 AM
70
cve
cve

CVE-2022-1213

SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass...

8.1CVSS

7.9AI Score

0.001EPSS

2022-04-05 04:15 AM
80
cve
cve

CVE-2022-1176

Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to...

7.5CVSS

7.5AI Score

0.001EPSS

2022-03-31 10:15 AM
65
cve
cve

CVE-2022-1191

SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to...

8.1CVSS

7.9AI Score

0.001EPSS

2022-03-31 09:15 AM
80
cve
cve

CVE-2022-25610

Unauthenticated Stored Cross-Site Scripting (XSS) in Simple Ajax Chat <= 20220115 allows an attacker to store the malicious code. However, the attack requires specific conditions, making it hard to...

6.1CVSS

5.7AI Score

0.001EPSS

2022-03-25 07:15 PM
55
cve
cve

CVE-2022-0612

Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to...

5.4CVSS

5.1AI Score

0.001EPSS

2022-02-16 06:15 AM
85
cve
cve

CVE-2022-0148

The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin...

5.4CVSS

5.1AI Score

0.001EPSS

2022-02-07 04:16 PM
32
Total number of security vulnerabilities259