matrix-react-sdk vulnerable to XSS in Export Chat feature

Description The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS. Impact Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restrictin...

GHSA-C9VX-2G7W-RP65 matrix-react-sdk vulnerable to XSS in Export Chat feature

Description The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS. Impact Since the Export Chat feature generates a separate document, an attacker can only inject code run from the null origin, restrictin...

WordPress Number Chat Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Number Chat Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8cd1dd5221d3 Credits Rafie Muhammad Patchstack Required...

matrix-react-sdk 跨站脚本漏洞

matrix-react-sdk is a Matrix open source component for inserting the Matrix chat/voip client into web pages. A cross-site scripting vulnerability exists in matrix-react-sdk versions 3.32.0 through 3.76.0, which stems from the Export Chat feature containing certain attacker-controlled elements in...

WordPress Chat Button- Leads and Order over Chat Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Chat Button- Leads and Order over Chat Type Plugin Vulnerable versions = 1.6.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4d0fb978d5e8 Credits Rafie...

element-web -- Cross site scripting in Export Chat feature

Matrix Developers reports: The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS...

WordPress Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Go Viral – social share, social sharebar, social locker, social chat, open graph, reactions, share & view counters Type Plugin Vulnerable versions = 1.8.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severit...

WordPress Customer Chat Facebook Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Customer Chat Facebook Type Plugin Vulnerable versions = 1.1.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 36d502d50ea9 Credits Rafie Muhammad Patchstack...

FreeBSD : element-web -- Cross site scripting in Export Chat feature (c70c3dc3-258c-11ee-b37b-901b0e9408dc)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c70c3dc3-258c-11ee-b37b-901b0e9408dc advisory. - Since the Export Chat feature generates a separate document, an attacker can only inject code run fro...

CVE-2023-3245

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3418

Rejected reason: The issue is not in the plugin itself but the underlying chat service...

CVE-2023-3245 Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3245 Floating Chat Widget < 3.1.2 - Admin+ Stored Cross-Site Scripting

The Floating Chat Widget WordPress plugin before 3.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress Plugin Floating Chat Widget 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Chat Button Plugin <= 1.8.9.4 is vulnerable to Cross Site Scripting (XSS)

Software Chat Button Type Plugin Vulnerable versions = 1.8.9.4 Fixed in 1.8.10 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-32292 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9c87f016ddc7 Credits Jayasuryapal G Required...

Malicious code in fb-chat-fca (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40cfd2dc0e1c91cb5fe67a2826fcfbea3df53885e338a77776a08efcfa7513f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-326 Malicious code in fb-chat-fca (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40cfd2dc0e1c91cb5fe67a2826fcfbea3df53885e338a77776a08efcfa7513f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.

Impact A Cross-Site Scripting XSS vulnerability was found in the HTML output of chats. XSS is intended to be mitigated by Jinja's escape function. However, autoescape=True was missing when setting the environment. Although the actual impact is low, considering the HTML file is being viewed offlin...

PT-2023-32997 · Unknown · Whatsapp-Chat-Exporter

Name of the Vulnerable Software and Affected Versions: WhatsApp-Chat-Exporter versions prior to 0.9.5 Description: A Cross-Site Scripting XSS issue was discovered in the HTML output of chats, due to the absence of autoescape=True when setting the environment, which is intended to be mitigated by...

chat.server-grenslandradio.nl Cross Site Scripting vulnerability OBB-3491229

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...