CVE-2026-81807

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-81807

CVE-2026-81807 affects the Simple Ajax Chat WordPress plugin prior to version 20260827 . The root cause is that chat message content is not properly escaped during the linkification process before rendering, resulting in an unauthenticated stored XSS . An attacker can inject arbitrary HTML attrib...

CVE-2026-81807 Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

EUVD-2026-69859

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators...

CVE-2026-36227

CVE-2026-36227: Easy Chat Server 3.1 UserName Path Traversal PoC Este repositorio contiene una prueba de concepto benigna para CVE-2026-36227, un problema de path traversal en el manejo del registro de usuarios de Easy Chat Server 3.1. Este repositorio es únicamente para investigación de segurida...

CVE-2026-66750-Insufficient-Access-Controls-Allow-for-Unauthorized-File-Downloads-Let-s-Chat-

Бюллетень безопасности: недостаточные средства контроля доступа позволяют неавторизованно скачивать файлы Let's Chat Назначенный CVE ID: CVE-2026-66750 Краткое описание GET /files/:id/:name проверяет, что вызывающий пользователь выполнил вход, и затем отдаёт файл. Он никогда не проверяет, разреше...

EUVD-2026-66381

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user...

CVE-2026-84287

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

CVE-2026-84287

A denial-of-service vulnerability exists in NousResearch hermes-agent 0.18.0 , specifically within the Session Chat Interface component in the file gateway/platforms/api_server.py. The flaw allows a remote attacker with low privileges to cause a service disruption. The exploit is reported as publ...

EUVD-2026-69699

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The...

PoC-CVE-2025-62222

PoC: CVE-2025-62222 - GitHub Copilot Chat RCE Этот репозиторий содержит Доказательство концепции PoC для уязвимости CVE-2025-62222. Он демонстрирует, как можно добиться удаленного выполнения кода RCE на машине разработчика, манипулируя контекстом GitHub Copilot Chat в VS Code с помощью скрытой...

MobSF_AI

MobSF AI 사이드카 이 프로젝트는 Mobile Security Framework MobSF에 AI 기반 채팅 어시스턴트를 추가합니다. 보안 분석가가 MobSF에서 생성된 분석 보고서에 대해 인터페이스 내에서 직접 질문할 수 있도록 하며, OpenAI의 모델을 활용합니다. 기능 원활한 통합 : Nginx 리버스 프록시를 사용하여 MobSF 보고서에 특화된 채팅 인터페이스를 직접 주입합니다. 컨텍스트 인식 : AI 어시스턴트가 현재 분석 보고서정적 분석를 자동으로 검색하여 질문에 답변하는 컨텍스트로 사용합니다. 대화형 Q &...

POC_CVE-2024-40492

CVE-2024-40492 : XSS stocké menant à ATO Description Le Cross-Site Scripting stocké XSS est un type de vulnérabilité de sécurité généralement présent dans les applications web. Il se produit lorsqu'un attaquant parvient à injecter des scripts malveillants dans une application web et que ces scrip...

CVE-2026-66751-Insufficient-Access-Controls-Allow-for-Unauthorized-Room-Deletion-Let-s-Chat-

Avis de sécurité : Contrôles d'accès insuffisants permettant la suppression non autorisée de salons Let's Chat Identifiant CVE attribué : CVE-2026-66751 Résumé DELETE /rooms/:room n'effectue aucun contrôle d'autorisation au-delà de l'obligation de connexion. N'importe quel compte peut archiver...

CVE-2026-66749-Unchecked-Room-Lookup-Leads-to-Server-Crash-Let-s-Chat-

Avis de sécurité : une recherche de salon non contrôlée entraîne le crash du serveur Let's Chat Identifiant CVE attribué : CVE-2026-66749 Résumé Une seule requête HTTP provenant de n'importe quel compte connecté arrête le processus du serveur Let's Chat. GET /messages prend un paramètre room,...

CVE-2025-56515

CVE-2025-56515 Vulnérabilité de script intersite XSS dans l'application de chat Fiora CVE-2025-56515 : Vulnérabilité de script intersite XSS dans l'application de chat Fiora Aperçu de la vulnérabilité Identifiant CVE : CVE-2025-56515 Type de vulnérabilité : Script intersite XSS Type d'attaque : À...

CVE-2026-79483

FastGPT Community Edition 4.10.0 through 4.14.0 are vulnerable to a NoSQL injection in the POST /api/core/chat/getHistories endpoint. An unauthenticated attacker can inject malicious NoSQL operators via crafted JSON payloads to bypass authorization checks, resulting in unauthorized access to chat...

tfc — Updated!

Tinfoil Chat Tinfoil Chat TFC is a FOSS+FHD peer-to-peer messaging system that relies on high assurance hardware architecture to protect users from passive collection, MITM attacks and most importantly, remote key exfiltration. TFC is designed for people with one of the most complex threat models...

pisiguard

PISIGuard Protégez vos informations personnelles et sensibles lorsque vous discutez avec une IA PISIGuard : P ersonnellement I dentifiables & S ensibles I nformations G arde Démo PISIGuard. Les données sensibles sont détectées, masquées et restaurées directement dans le navigateur J’ai créé...

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...