CVE-2025-5336

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-nonumber’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-5336 Click to Chat <= 4.22 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via data-no_number Parameter

The Click to Chat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘data-nonumber’ parameter in all versions up to, and including, 4.22 to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level acces...

CVE-2025-5336

CVE-2025-5336 concerns WordPress plugin “Click to Chat” for HoliThemes. The vulnerability is a Stored DOM-based Cross-Site Scripting via the data-no_number parameter in versions up to 4.22, caused by insufficient input sanitization and output escaping. Exploitation requires authenticated access a...

WordPress plugin Click to Chat 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Click to Chat plugin, which stems from insufficient input cleanup and escaping, and can be exploited by an attacker ...

PT-2025-25474 · WordPress · Click To Chat

Name of the Vulnerable Software and Affected Versions: Click to Chat plugin for WordPress versions up to, and including, 4.22 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

CVE-2025-5881

A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...

[SECURITY] Fedora 42 Update: nheko-0.12.0-15.fc42

The motivation behind the project is to provide a native desktop app for Matrix that feels more like a mainstream chat app...

CVE-2024-8270 macOS Rocket.Chat: TCC Policy Bypass via Dylib Injection Due to Missing Code Signing Flags and Dangerous Entitlements

The macOS Rocket.Chat application is affected by a vulnerability that allows bypassing Transparency, Consent, and Control TCC policies, enabling the exploitation or abuse of permissions specified in its entitlements e.g., microphone, camera, automation, network client. Since Rocket.Chat was not...

BlackSuit Continues Social Engineering Attacks in Wake of Black Basta’s Internal Conflict

Executive Summary There has been a significant decrease in social engineering attacks linked to the Black Basta ransomware group since late December 2024. This lapse also included the leaked Black Basta chat logs in February 2025, indicating internal conflict within the group. Despite this, Rapid...

PT-2025-38699

Name of the Vulnerable Software and Affected Versions Lightspeed affected versions not specified Description A flaw exists in the Lightspeed history service due to insufficient access controls. A local, unprivileged user can access and manipulate the chat history of another user on the same syste...

CVE-2025-5881

A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-5881

A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-5881 code-projects Chat System confirm_password.php sql injection

A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-5881 code-projects Chat System confirm_password.php sql injection

A vulnerability was found in code-projects Chat System up to 1.0 and classified as critical. This issue affects some unknown processing of the file /user/confirmpassword.php. The manipulation of the argument cid leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-5881

CVE-2025-5881 affects code-projects Chat System (versions up to 1.0). Multiple connected sources describe a vulnerability in /user/confirm_password.php where manipulating the parameter cid allows an SQL injection. Exploitation can be remote and the vulnerability has been disclosed publicly. Evide...

Rocket.Chat 安全漏洞

Rocket.Chat is a chat program from Rocket.Chat, Inc. A security vulnerability exists in Rocket.Chat versions 7.6.1 and earlier, which stems from inefficient regular expression complexity due to incorrect manipulation of the parameter line in file...

PT-2025-24441 · Code Projects · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System versions up to 1.0 Description: A critical issue affects the processing of the file /user/confirm password.php. The manipulation of the cid argument leads to SQL injection. The attack can be initiated remotely...

CVE-2025-30977

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chaport Live Chat Chaport chaport allows Stored XSS.This issue affects Chaport: from n/a through = 1.1.6...

CVE-2025-5018

The Hive Support plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the hsupdateaichatsettings and hivelitesupportgetallbinbox functions in all versions up to, and including, 1.2.5. This makes it possible for authenticated...

CVE-2025-20129

A vulnerability in the web-based chat interface of Cisco Customer Collaboration Platform CCP, formerly Cisco SocialMiner, could allow an unauthenticated, remote attacker to persuade users to disclose sensitive data. This vulnerability is due to improper sanitization of HTTP requests that are sent...