CVE-2025-51863

CVE-2025-51863 漏洞描述 ChatGPTUtil 是一款基于 AI 的聊天机器人助手，提供对 ChatGPT 和 AI 图像生成器的访问。聊天组件中存在一个自跨站脚本（Self-XSS）漏洞。该漏洞可能导致 cookie 被窃取，进而实现远程账户劫持。 攻击向量 攻击向量为网络。要利用此 XSS 漏洞，攻击者必须构造恶意载荷（例如 SVG XSS 载荷），并将其传递给受害者（例如通过电子邮件、恶意网站、论坛帖子或即时消息）。当受害者将载荷粘贴到 ChatGPTUtil 聊天界面时，攻击就会发生。POC 如下： root@kitploit:...

CVE-2025-51869

CVE-2025-51869 漏洞描述 Liner 是一个可靠的AI搜索引擎，全球用户超过1000万。Liner 构建了一个基于LLM的搜索引擎，其聊天组件存在不安全的直接对象引用（IDOR）漏洞。攻击者可以利用此IDOR篡改其他用户的对话。 攻击向量 所有用户的对话历史都存储在服务器上。然而，Liner的服务器不区分单个对话历史的所有权或共享状态。因此，攻击者可以通过暴力破解对话消息ID来访问其他用户的对话历史。此外，还存在spaceid和threadid，我们发现当请求对话历史时，服务器仅检查messageid来检索对话。...

CVE-2025-51864

CVE-2025-51864 Descripción de la vulnerabilidad AIBOX es una aplicación web para explorar consultoría de IA y probar múltiples LLM. Permite a los usuarios chatear con varios LLM. Existe una vulnerabilidad de cross-site scripting XSS reflejado en el componente de chat, que podría provocar el robo ...

CVE-2025-51868

CVE-2025-51868 漏洞描述 Dippy 是一个流行的网站，用于与数百万个主动式 AI 角色聊天。Dippy 允许用户与基于 LLM 的角色聊天，但其聊天组件存在不安全的直接对象引用（IDOR）漏洞。攻击者可以利用此 IDOR 篡改其他用户的对话。 攻击向量 所有用户的对话历史都存储在服务器上。然而，Dippy 的服务器并不区分各个对话历史的所有权或共享状态。因此，攻击者可以通过暴力破解对话 ID 来访问其他用户的对话历史。 对话 ID 格式可预测且易受暴力破解攻击。它由 8 个字符组成，该字符串由数字组成（例如 12345678）。当攻击者使用攻击者的 Authorizati...

EUVD-2026-71216

IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...

EUVD-2025-209411

A vulnerability has been found in 1Panel-dev MaxKB up to 2.4.2. Impacted is an unknown function of the file ui/src/chat.ts of the component MdPreview. Such manipulation leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed to the public and may be used...

EUVD-2008-6843

Malware in sbrugna...

EUVD-2024-35259

Malicious code in bioql PyPI...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

CVE-2025-51859

Stored Cross-Site Scripting XSS vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the underlying Large Language Model LLM to embed malicious script payloads...

CVE-2025-51862

Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...

PT-2025-30419 · Telegai · Telegai

Name of the Vulnerable Software and Affected Versions: TelegAI affected versions not specified Description: The application contains a stored cross-site scripting XSS issue in its chat component and character container component. An attacker can execute arbitrary client-side scripts by creating a...

CVE-2025-51860

TelegAI (telegai.com) is affected by a Stored XSS (CVE-2025-51860) in its chat component and character container. The vulnerability allows an attacker to craft an AI Character with SVG XSS payloads in fields such as description, greeting, example dialog, or system prompt, causing arbitrary client...

CVE-2025-51862

TelegAI (telegai.com) is affected by an Insecure Direct Object Reference (IDOR) vulnerability in its chat component. Exploitation relies on manipulating the profile_id in chat-related API calls (as evidenced by the GitHub exploit, PT-2025-30420 description, and other reports), enabling an attacke...

Chaindesk Cross Site Scripting

Chaindesk, a web application for constructing AI Agents, is vulnerable to a persistent cross site scripting vulnerability in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the underlying Large Language...

Exploit for CVE-2025-51864

CVE-2025-51864 Vulnerability description AIBOX is a web...

PT-2025-26736 · Mitel · Mitel Micontact Center Business

Name of the Vulnerable Software and Affected Versions: Mitel MiContact Center Business versions through 10.2.0.3 Description: A vulnerability in the legacy chat component could allow an unauthenticated attacker to conduct an information disclosure attack due to improper handling of session data. ...

PT-2025-26737 · Mitel · Mitel Micontact Center Business

Name of the Vulnerable Software and Affected Versions: Mitel MiContact Center Business versions 10.0.0.0 through 10.0.0.4 Mitel MiContact Center Business versions 10.1.0.0 through 10.1.0.5 Mitel MiContact Center Business versions 10.2.0.0 through 10.2.0.4 Description: A vulnerability in the legac...

CVE-2024-42514

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthorized access attack due to inadequate access control checks. A successful exploit requires user interaction and could allow an attacker to...