CVE-2026-30048

A stored cross-site scripting XSS vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when t...

CVE-2026-30048

A stored cross-site scripting (XSS) vulnerability exists in the NotChatbot WebChat widget, specifically within the @developer.notchatbot/webchat package. Affected versions include all versions up to and including 1.5.0 (specifically noted as thru 1.4.4 in some records). The root cause is the impr...

CVE-2026-30048: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when t...

CVE-2026-30048

A stored cross-site scripting XSS vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when t...

WebChat 安全漏洞

WebChat is an online real-time chat service developed by NotChatbot’s individual developer, designed for website integration. Versions of WebChat 1.4.4 and earlier contained security vulnerabilities. These vulnerabilities stemmed from improper cleaning of user input before it was stored and...

PT-2026-26106

A stored cross-site scripting XSS vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when t...

CVE-2026-30048

A stored cross-site scripting XSS vulnerability exists in the NotChatbot WebChat widget thru 1.4.4. User-supplied input is not properly sanitized before being stored and rendered in the chat conversation history. This allows an attacker to inject arbitrary JavaScript code which is executed when t...

GHSA-MQPW-46FH-299H OpenClaw authorization bypass: operator.write can resolve exec approvals via chat.send -> /approve

Summary What this means plain language If you give a client “chat/write” access to the gateway operator.write but you do not intend to let that client approve exec requests operator.approvals, affected versions could still let that client approve/deny a pending exec approval by sending the /appro...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The package was flagged as malicious during the Sha1-hulud supply chain attack. Although the Sha1-hulud IoCs are not present within the package, the contents of the affected version were removed from the officia...

Malicious code in @freeday-ai/webchat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c83e58d7d44e29e5ff1bbf1fde3e4796cb2a04716c72ccd63d1e9d5c98b5054e The package @freeday-ai/webchat was found to contain malicious code. Source: ghsa-malware...

MAL-2025-191454 Malicious code in @freeday-ai/webchat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c83e58d7d44e29e5ff1bbf1fde3e4796cb2a04716c72ccd63d1e9d5c98b5054e The package @freeday-ai/webchat was found to contain malicious code. Source: ghsa-malware...

D-Link DI-7100G C1 popupId parameter buffer overflow vulnerability

The D-Link DI-7100G C1 is an enterprise-class router from D-Link, designed for small and medium-sized businesses. The D-Link DI-7100G C1 suffers from a buffer overflow vulnerability that originates from the parameter popupId in the file /webchat/hiblock.asp failing to properly validate the length...

D-Link DI-7100G C1 openid parameter buffer overflow vulnerability

The D-Link DI-7100G C1 is an enterprise-class router from D-Link, designed for small and medium-sized businesses. The D-Link DI-7100G C1 suffers from a buffer overflow vulnerability that originates from the parameter openid in the file /webchat/login.cgi failing to properly validate the length an...

The vulnerability of the sub_4BD4F8() function in the /webchat/hi_block.asp file of the D-Link DI-7100G router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the sub4BD4F8 function in the /webchat/hiblock.asp file of the D-Link DI-7100G router’s software lies in the fact that the operation results are written outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

EUVD-2007-3518

Malware in sbrugna...

EUVD-2008-1411

Malware in sbrugna...

EUVD-2007-0483

Malware in sbrugna...

EUVD-2002-2369

Malware in sbrugna...

EUVD-2025-32557

A vulnerability has been found in D-Link DI-7100G C1 up to 20250928. This issue affects the function sub4BD4F8 of the file /webchat/hiblock.asp of the component jhttpd. The manipulation of the argument popupId leads to buffer overflow. The attack can be initiated remotely. The exploit has been...

EUVD-2025-32550

A flaw has been found in D-Link DI-7100G C1 up to 20250928. This vulnerability affects the function sub4C0990 of the file /webchat/login.cgi of the component jhttpd. Executing manipulation of the argument openid can lead to buffer overflow. It is possible to launch the attack remotely. The exploi...