PT-2025-42448

Name of the Vulnerable Software and Affected Versions ChatLuck affected versions not specified Description ChatLuck contains a cross-site scripting issue within its Chat Rooms functionality. Successful exploitation could allow an attacker to execute arbitrary scripts in a user's web browser...

CVE-2025-10660 WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id

The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-10660 WP Dashboard Chat <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id

The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CVE-2025-10660

CVE-2025-10660 details (CWE: SQL Injection). The WP Dashboard Chat plugin for WordPress is vulnerable via the id parameter in all versions up to 1.0.3 due to insufficient escaping of user input and inadequate preparation of the existing SQL query. This enables authentication-conscious actors with...

WordPress WP Dashboard Chat plugin <= 1.0.3 - Authenticated (Contributor+) SQL Injection via id vulnerability

Authenticated Contributor+ SQL Injection via id vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin WP Dashboard Chat versions = 1.0.3...

CVE-2025-10660: Improper Neutralization of Special Elements used in an SQL Command

The WP Dashboard Chat plugin for WordPress is vulnerable to SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

PT-2025-42302

Name of the Vulnerable Software and Affected Versions WP Dashboard Chat plugin for WordPress versions up to and including 1.0.3 Description The WP Dashboard Chat plugin for WordPress is susceptible to SQL Injection through the id parameter. Insufficient escaping of user-supplied input and...

WordPress plugin WP Dashboard Chat has a SQL injection vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A SQL injecti...

CVE-2025-60374

Stored Cross-Site Scripting XSS in Perfex CRM chatbot before 3.3.1 allows attackers to inject arbitrary HTML/JavaScript. The payload is executed in the browsers of users viewing the chat, resulting in client-side code execution, potential session token theft, and other malicious actions. A...

Rocket.Chat: SSRF via Improper Redirect Validation in Rocket.Chat oEmbed Function

A vulnerability was discovered in Rocket.Chat version 7.10.1 where the oEmbed feature did not properly validate redirected URLs. This allowed an attacker to bypass SSRF protections and access internal network resources that would otherwise be unreachable...

Business Chat Function Microsoft 365 Copilot Spear Phishing

The vulnerability of the Business Chat function in Microsoft 365 Copilot is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

Business Chat Function Microsoft 365 Copilot Spear Phishing

The vulnerability of the Business Chat function in Microsoft 365 Copilot is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow attackers to perform spear-phishing attacks remotely...

WordPress AI ChatBot with ChatGPT and Content Generator by AYS plugin <= 2.6.6 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by n0arafatn0 in WordPress Plugin AI ChatBot with ChatGPT and Content Generator by AYS versions = 2.6.6...

CVE-2025-61602

BigBlueButton is an open-source virtual classroom. A denial-of-service DoS vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed reactionEmojiId in the GraphQL mutation...

Malicious Package

Overview melichat-chat-library is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in melichat-chat-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83c2d41e4c7fa96605141a046fcb172ffe601946ad931be7b5e96e935803c75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48284 Malicious code in melichat-chat-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83c2d41e4c7fa96605141a046fcb172ffe601946ad931be7b5e96e935803c75f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2025-33605

Malicious code in melichat-chat-library npm...

EUVD-2025-33722

Stored HTML injection in RISE Ultimate Project Manager & CRM allows authenticated users to inject arbitrary HTML into invoices and messages. Injected content renders in emails, PDFs, and messaging/chat modules sent to clients or team members, enabling phishing, credential theft, and business emai...

CVE-2025-61602

BigBlueButton is an open-source virtual classroom. A denial-of-service DoS vulnerability in versions prior to 3.0.13 allows any authenticated user to crash the chat functionality for all participants in a meeting by sending a malformed reactionEmojiId in the GraphQL mutation...