BIT-LIVEHELPERCHAT-2020-26135

Live Helper Chat before 3.44v allows reflected XSS via the setsettingajax PATHINFO...

BIT-DISCOURSE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

Cross site scripting

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

Grouptime Teamwire Client Security Vulnerability

Grouptime Teamwire Client is an enterprise messaging client application from Grouptime Germany. A security vulnerability exists in Grouptime Teamwire Client versions v.2.0.1 through v.2.4.0. A remote attacker could exploit the vulnerability to obtain sensitive information via a specially crafted...

CVE-2024-24276

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

PT-2024-20334 · Teamwire · Teamwire Windows Desktop Client

Name of the Vulnerable Software and Affected Versions: Teamwire Windows desktop client versions 2.0.1 through 2.4.0 Description: A Cross Site Scripting XSS issue allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username, and group...

CVE-2024-24276

Cross Site Scripting XSS vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the chat name, message preview, username and group name components...

CVE-2024-0968

CVE-2024-0968 entry is rejected/not used and not an active vulnerability.

Cross site scripting

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This...

CVE-2024-0378

CVE-2024-0378 affects the AI Engine plugin for WordPress, specifically versions up to and including 2.2.0. The issue is stored XSS caused by insufficient input sanitization and output escaping in the AI chat data when discussion tracking is enabled. Impact: unauthenticated attackers can inject sc...

CVE-2024-0378 AI Engine <= 2.2.0 - Unauthenticated Stored Cross-Site Scripting

The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the AI chat data when discussion tracking is enabled in all versions up to, and including, 2.2.0 due to insufficient input sanitization and output escaping. This...

PT-2024-15948 · Langchain Ai · Chat-Langchain

Name of the Vulnerable Software and Affected Versions: langchain-ai/chat-langchain versions prior to 0.0.0 Description: The issue is related to Cross-site Scripting XSS - DOM. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents wher...

PT-2024-15512 · WordPress · The Ai Engine: Chatbots

Name of the Vulnerable Software and Affected Versions: The AI Engine: Chatbots, Generators, Assistants, GPT 4 and more! plugin for WordPress versions up to, and including, 2.2.0 Description: The issue is related to Stored Cross-Site Scripting via the AI chat data when discussion tracking is...

Session fixation

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...

CVE-2024-2045 Session 1.17.5 - LFR via chat attachment

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...

CVE-2024-2045 Session 1.17.5 - LFR via chat attachment

Session version 1.17.5 allows obtaining internal application files and public files from the user's device without the user's consent. This is possible because the application is vulnerable to Local File Read via chat attachments...

livehelperchat Security Breach

livehelperchat is an open source application that provides free live support on a website through live helperchat. A security vulnerability exists in livehelperchat version 4.28v, which stems from the presence of a Server Template Injection SSTI vulnerability...

PT-2024-18665 · Session · Session

Name of the Vulnerable Software and Affected Versions: Session version 1.17.5 Description: The application is vulnerable to Local File Read via chat attachments, allowing internal application files and public files from the user's device to be obtained without the user's consent. Recommendations:...

Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS

Description The plugin does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users. await fetch"http://vulnerable-site.tld/wp-content/plugins/simple-ajax-chat/simple-ajax-chat-core.php?sacSendChat=yes", "credentials": "include",...

Simple Ajax Chat < 20240223 - Unauthenticated Stored XSS

Description The plugin does not prevent visitors from using malicious Names when using the chat, which will be reflected unsanitized to other users. PoC await fetch"http://vulnerable-site.tld/wp-content/plugins/simple-ajax-chat/simple-ajax-chat-core.php?sacSendChat=yes", "credentials": "include",...