Microsoft 365 Copilot Business Chat Spoofing Vulnerability

Microsoft 365 Copilot Business Chat is an AI chat software from Microsoft Corporation, USA. Microsoft 365 Copilot Business Chat has a spoofing vulnerability that can be exploited by attackers to cause spoofing attacks...

CVE-2025-60511

Moodle OpenAI Chat Block plugin 3.0.1 2025021700 suffers from an Insecure Direct Object Reference IDOR vulnerability due to insufficient validation of the blockId parameter in /blocks/openaichat/api/completion.php. An authenticated student can impersonate another user's block e.g., administrator...

CVE-2025-60511: Authorization Bypass Through User-Controlled Key

Moodle OpenAI Chat Block plugin 3.0.1 2025021700 suffers from an Insecure Direct Object Reference IDOR vulnerability due to insufficient validation of the blockId parameter in /blocks/openaichat/api/completion.php. An authenticated student can impersonate another user's block e.g., administrator...

CVE-2025-62763

CVE-2025-62763 affects Zimbra Collaboration (ZCS) before 10.1.12. The root cause is a misconfiguration of the chat proxy that enables SSRF. The CVSS base metrics indicate a Network attack with Low complexity, Privileges Required: Low, and no user interaction, with partial impact on integrity. The...

CVE-2025-62763

Zimbra Collaboration ZCS before 10.1.12 allows SSRF because of the configuration of the chat proxy...

CVE-2025-62763

Zimbra Collaboration ZCS before 10.1.12 allows SSRF because of the configuration of the chat proxy...

EUVD-2025-35204

Zimbra Collaboration ZCS before 10.1.12 allows SSRF because of the configuration of the chat proxy...

PT-2025-42911

Name of the Vulnerable Software and Affected Versions Moodle OpenAI Chat Block plugin version 3.0.1 2025021700 Description The Moodle OpenAI Chat Block plugin is affected by an Insecure Direct Object Reference IDOR issue. Insufficient validation of the blockId parameter in the '/blocks/openai...

EUVD-2025-35199

Moodle OpenAI Chat Block plugin 3.0.1 2025021700 suffers from an Insecure Direct Object Reference IDOR vulnerability due to insufficient validation of the blockId parameter in /blocks/openaichat/api/completion.php. An authenticated student can impersonate another user's block e.g., administrator...

CVE-2025-56320

Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code. NOTE: the Supplier reports that this is "Present only in an obsolete, unsupported version no longer in circulation."...

CVE-2025-8349

Cross-site Scripting XSS stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed witho...

CVE-2025-8349 Cross-Site Scripting (XSS) stored in Tawk Live Chat

Cross-site Scripting XSS stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed witho...

CVE-2025-8349 Cross-Site Scripting (XSS) stored in Tawk Live Chat

Cross-site Scripting XSS stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed witho...

EUVD-2025-35044

Cross-site Scripting XSS stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed witho...

CVE-2025-8349

CVE-2025-8349 denotes a stored XSS in Tawk Live Chat. A malicious PDF with JavaScript uploaded via the chatbot is stored by the application and later rendered unsanitized to other users, enabling execution of arbitrary script (e.g., cookie theft) in the victim’s browser. Affected components inclu...

Tawk Live Chat Cross-Site Script Vulnerability

tawk.to Tawk Live Chat is an online chat software from the US company tawk.to. A cross-site scripting vulnerability exists in Tawk Live Chat that stems from not properly cleaning JavaScript code when storing PDF files, which could lead to a stored cross-site scripting attack...

CVE-2025-8349: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS stored vulnerability in Tawk Live Chat. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by uploading a malicious PDF with JavaScript payload through the chatbot. The PDF is stored by the application and subsequently displayed witho...

PT-2025-42756

Name of the Vulnerable Software and Affected Versions Tawk Live Chat affected versions not specified Description A stored Cross-Site Scripting XSS issue exists in Tawk Live Chat. An attacker can execute JavaScript code in a victim’s browser by uploading a malicious PDF file containing a JavaScrip...

EUVD-2025-34913

Enterprise Contract Management Portal v.22.4.0 is vulnerable to Stored Cross-Site Scripting XSS in its chat box component. This allows a remote attacker to execute arbitrary code...

CVE-2025-62505

LobeChat is an open source chat application platform. The web-crawler package in LobeChat version 1.136.1 allows server-side request forgery SSRF in the tools.search.crawlPages tRPC endpoint. A client can supply an arbitrary urls array together with impls containing the value naive. The service...