122 matches found
Fiora chat group avatar is vulnerable to XSS via SVG files
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...
CVE-2025-56514
Cross Site Scripting XSS vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users...
CVE-2025-56514
Cross Site Scripting XSS vulnerability in Fiora chat application 1.0.0 allows executes arbitrary JavaScript when malicious SVG files are rendered by other users...
CVE-2025-56515
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...
CVE-2025-56515
File upload vulnerability in Fiora chat application 1.0.0 through user avatar upload functionality. The application fails to validate SVG file content, allowing malicious SVG files with embedded foreignObject elements containing iframe tags and JavaScript event handlers onmouseover to be uploaded...
Collaborative Intelligence: Topic Modelling of Large Language Model Use in Live Cybersecurity Operations
Objective: This work describes the topic modelling of Security Operations Centre SOC use of a large language model LLM, during live security operations. The goal is to better understand how these specialists voluntarily use this tool. Background: Human-automation teams have been extensively...
CVE-2025-53940
CVE-2025-53940 affects Quiet, an open-source p2p chat alternative. Vulnerable in Quiet 6.1.0-alpha.4 and earlier due to an insecure, non-constant-time token verification comparison in the backend/frontend API, enabling a timing attack to guess the token character by character. The issue is resolv...
Ai2 Insecure Direct Object Reference
Ai2 is a Seattle based non-profit AI research institute. Ai2 provides a playground web application to chat that is susceptible to an insecure direct object reference vulnerability. An attacker can exploit this IDOR to tamper other users' conversation...
[SECURITY] Fedora 42 Update: nheko-0.12.0-15.fc42
The motivation behind the project is to provide a native desktop app for Matrix that feels more like a mainstream chat app...
CVE-2024-52489
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through = 2.1.5...
CVE-2024-31258
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Micro.Company Form to Chat App allows Stored XSS.This issue affects Form to Chat App: from n/a through 1.1.6...
CVE-2024-1761
The WP Chat App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget/block in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping on user supplied attributes such as 'buttonColor' and 'phoneNumber'. This makes it...
CVE-2023-51370
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in NinjaTeam WP Chat App allows Stored XSS.This issue affects WP Chat App: from n/a through 3.4.4...
CVE-2024-52489
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through = 2.1.5...
CVE-2024-52489 WordPress Add Chat App Button plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through = 2.1.5...
CVE-2024-52489
CVE-2024-52489 refers to a stored XSS vulnerability in the WordPress plugin Add Chat App Button (versions <= 2.1.5). The issue arises from improper input neutralization during web page generation, enabling injected scripts. Affected software: WordPress Add Chat App Button plugin
PT-2024-35329 · Udi Dollberg · Add Chat App Button
Name of the Vulnerable Software and Affected Versions: Udi Dollberg Add Chat App Button versions 2.1.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This enables potentia...
CVE-2024-52489: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in udidol Add Chat App Button add-whatsapp-button allows Stored XSS.This issue affects Add Chat App Button: from n/a through = 2.1.5...
WordPress Add Chat App Button plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by UKO Patchstack Alliance in WordPress Plugin Add Chat App Button versions = 2.1.5...
WordPress Add Chat App Button Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)
Software Add Chat App Button Type Plugin Vulnerable versions = 2.1.5 Fixed in 2.1.8 OWASP Top 10 A4: Insecure Design Classification Cross Site Scripting XSS CVE CVE-2024-52489 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 6803fb6fee9d Credits UKO Required privilege...