8154 matches found
CVE-2024-8270 macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements
The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control TCC policies, enabling the exploitation or abuse of permissions specified in its entitlements e.g., microphone, camera, automation, network client. Since Rocket.Chat was not...
BlackSuit Continues Social Engineering Attacks in Wake of Black Basta’s Internal Conflict
Executive Summary There has been a significant decrease in social engineering attacks linked to the Black Basta ransomware group since late December 2024. This lapse also included the leaked Black Basta chat logs in February 2025, indicating internal conflict within the group. Despite this, Rapid...
PT-2025-38699
Name of the Vulnerable Software and Affected Versions Lightspeed affected versions not specified Description A flaw exists in the Lightspeed history service due to insufficient access controls. A local, unprivileged user can access and manipulate the chat history of another user on the same syste...
CVE-2025-5881
A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...
CVE-2025-5881
A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...
CVE-2025-5881 code-projects Chat System confirm_password.php sql injection
A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...
CVE-2025-5881 code-projects Chat System confirm_password.php sql injection
A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...
CVE-2025-5881
CVE-2025-5881 affects code-projects Chat System (versions up to 1.0). Multiple connected sources describe a vulnerability in /user/confirm_password.php where manipulating the parameter cid allows an SQL injection. Exploitation can be remote and the vulnerability has been disclosed publicly. Evide...
Rocket.Chat 安全漏洞
Rocket.Chat is a chat program from Rocket.Chat, Inc. A security vulnerability exists in Rocket.Chat versions 7.6.1 and earlier, which stems from inefficient regular expression complexity due to incorrect manipulation of the parameter line in file...
PT-2025-24441 · Code Projects · Code-Projects Chat System
Name of the Vulnerable Software and Affected Versions: code-projects Chat System versions up to 1.0 Description: A critical issue affects the processing of the file /user/confirm password.php. The manipulation of the cid argument leads to SQL injection. The attack can be initiated remotely...
CVE-2025-30977
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through = 1.1.6...
CVE-2025-5018
The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...
CVE-2025-20129
A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform CCP, formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data. This vulnerability is due to improper sanitization of HTTP requests that are sent...
CVE-2025-30977
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through = 1.1.6...
CVE-2025-30977 WordPress Chaport <= 1.1.6 - Cross Site Scripting (XSS) Vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through = 1.1.6...
CVE-2025-30977
CVE-2025-30977 is a Stored XSS in the WordPress Chaport plugin (WP Live Chat + Chatbots) up to version 1.1.5. The root cause is improper input neutralization during web page generation. Affected software is the Chaport plugin for WordPress; the description notes Stored XSS but provides no exploit...
CVE-2025-5018
CVE-2025-5018 affects the WordPress Hive Support plugin (<= 1.2.4; Patch references include
PT-2025-24034 · WordPress · Hive Support
Name of the Vulnerable Software and Affected Versions: Hive Support | AI-Powered Help Desk, Live Chat & AI Chat Bot Plugin for WordPress versions 1.2.2 and earlier Description: The issue is related to Cross-Site Request Forgery due to incomplete or incorrect nonce validation in the hs update ai...
WordPress plugin WP Live Chat + Chatbots Plugin for WordPress – Chaport 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin ... WordPress plugin WP Live...
CVE-2025-20129
A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform CCP, formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data. This vulnerability is due to improper sanitization of HTTP requests that are sent...