8185 matches found
CVE-2022-51011 PocketMine-MP before 4.2.10 Denial of Service via Chat Messages
PocketMine-MP before 4.2.10 fails to validate the total length of incoming chat message blobs before splitting them by newline characters, allowing attackers to send large messages containing many newlines. Malicious clients can send megabyte-sized chat packets and bombard the server with thousan...
CVE-2026-36227
CVE-2026-36227: Easy Chat Server 3.1 UserName Path Traversal PoC This repository contains a benign proof of concept for CVE-2026-36227, a path traversal issue in Easy Chat Server 3.1 user registration handling. This repository is for authorized security research and local reproduction only. Do no...
CVE-2026-86123
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...
CVE-2026-86123
SQL Chat is a database connectivity tool that exposes four unauthenticated API endpoints under /api/connection (specifically execute.ts and test.ts). These endpoints accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts, effective...
EUVD-2026-71955
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...
CVE-2026-86123 SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints
SQL Chat contains four unauthenticated API endpoints that accept client-supplied database connection parameters and execute arbitrary SQL queries against attacker-specified hosts. Attackers can connect to internal databases, execute SQL commands, enumerate schemas, and pivot into the server's...
CVE-2026-18404
The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-18404
CVE-2026-18404 affects the Social Chat – Click To Chat App Button (WP WhatsApp Chat) WordPress plugin, versions up to and including 8.6.2 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping of the consent_message JSON attribute ...
EUVD-2026-71843
The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-18404 Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box
The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...
GHSA-M4RF-3FR8-XWX3 vulnerabilities
Vulnerabilities for packages: open-webui, nemo...
WordPress Social Chat plugin <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin WP Social Chat versions = 8.6.2...
CVE-2026-79418
EMX Tecnologia Gestao X version = 8.4 contains a Stored Cross-Site Scripting XSS vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other...
CVE-2026-8447
IBM Langflow OSS 1.0.0 through 1.11.2 suffer from a stored cross-site scripting vulnerability in the Playground chat interface...
CVE-2026-85674
aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...
CVE-2026-85607
Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...
EUVD-2026-71130
aider aider-chat automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd executed at startup or lint-cmd executed on the first file edit, which aider runs through a shell subprocess with shell=True witho...
EUVD-2026-71223
Blinko 1.8.7 contains an authorization bypass IDOR vulnerability in multiple tRPC procedures message.list, message.update, message.delete, message.clearAfter in server/routerTrpc/message.ts and conversation.clearMessages in server/routerTrpc/conversation.ts. Although these procedures require...
CVE-2026-8447
IBM Langflow OSS versions 1.0.0 through 1.11.2 contain a stored cross-site scripting vulnerability in the Playground chat interface. The root cause is the MarkdownField component rendering chat messages via the rehypeRaw plugin without a sanitization pass, allowing attacker-controlled LLM respons...