9463 matches found
CVE-2026-15462 Sticky Chat Widget <= 1.4.2 - Unauthenticated SQL Injection
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-15462
CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...
EUVD-2026-75954
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
PT-2026-89759
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
CVE-2026-15462: Improper Neutralization of Special Elements used in an SQL Command
The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...
CVE-2026-81825: Improper Neutralization of Input During Web Page Generation
The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...
EUVD-2026-74279
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket...
NPM: n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
NPM: n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket vulnerability discovered by ? in WordPress Npm n8n versions 2.37.7...
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...
GHSA-35JJ-42HP-8GMQ n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket
Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...
CVE-2026-81784
Deserialization of Untrusted Data vulnerability in Marcin Wise Chat wise-chat allows Object Injection.This issue affects Wise Chat: from n/a through 3.4.2...
EUVD-2026-74274
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node...
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...
NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
NPM: n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node vulnerability discovered by ? in WordPress Npm n8n versions 1.123.76...
GHSA-34FF-336R-5Q23 n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
Impact The OpenAI Chat Model node checked a custom base URL against the credential's allowed-domains configuration before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path reached an arbitrary host with the credential attached, so the domain...
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...
Missing Authorization
Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization through the chat completions process. An attacker can overwrite another user's message content by submitting a crafted request to the endpoint, causing the original message to be replace...
EUVD-2026-75178
Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint...
GHSA-FMQH-XP37-5HR8 Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint
Summary Any member of a channel who can post to it could also replace the text of a message written by a different member. The channel branch of the chat completions endpoint checked that the caller may write to the channel, and that the targeted message belongs to that channel, but never checked...