1623 matches found
MAL-2025-26635 Malicious code in mongodb-chatbot-eval (npm)
The package mongodb-chatbot-eval was found to contain malicious code...
WordPress AI Engine plugin 2.9.3-2.9.4 - Authenticated (Subscriber+) Arbitrary File Upload
Authenticated Subscriber+ Arbitrary File Upload vulnerability discovered by ISMAILSHADOW in WordPress Plugin AI Engine versions 2.9.3-2.9.4...
A week in security (July 21 – July 27)
A list of topics we covered in the week of July 21 to July 27 of 2025 Last week on Malwarebytes Labs: Steam games abused to deliver malware once again Watch out: Instagram users targeted in novel phishing campaign Age verification: Child protection or privacy risk? iPhone vs. Android: iPhone user...
SUSE-SU-2025:02529-1 Security update for MozillaFirefox, MozillaFirefox-branding-SLE
This update for MozillaFirefox, MozillaFirefox-branding-SLE fixes the following issues: MozillaFirefox is updated to the 140ESR series. Firefox Extended Support Release 140.0esr ESR: General - Reader View now has an enhanced Text and Layout menu with new options for character spacing, word spacin...
A week in security (July 14 – July 20)
Last week on Malwarebytes Labs: Meta execs pay the pain away with $8 billion privacy settlement Adoption agency leaks over a million records Meta AI chatbot bug could have allowed anyone to see private conversations WeTransfer walks back clause that said it would train AI on your files Chrome fix...
Hackers Are Finding New Ways to Hide Malware in DNS Records
Newly published research shows that the domain name system—a fundamental part of the web—can be exploited to hide malicious code and prompt injection attacks against chatbots...
McDonald’s AI bot spills data on job applicants
McDonald's has outsourced the initial stages of its hiring process to an AI chatbot which seems to have been built without proper security measures. Security researchers managed to extract personal information about McDonald's job applicants by simply guessing a username and the password “12345.”...
TuneShield: Mitigating Toxicity in Conversational AI While Fine-Tuning on Untrusted Data
Recent advances in foundation models, such as LLMs, have revolutionized conversational AI. Chatbots are increasingly being developed by customizing LLMs on specific conversational datasets. However, mitigating toxicity during this customization, especially when dealing with untrusted training dat...
PT-2025-28323 · WordPress · Ai Engine
Name of the Vulnerable Software and Affected Versions: The AI Engine plugin for WordPress versions up to, and including, 2.8.4 Description: The issue is related to Stored Cross-Site Scripting via the id parameter in the mwai chatbot shortcode. This is due to insufficient input sanitization and...
WordPress AI Engine plugin <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via `mwai_chatbot` Shortcode `id` Parameter vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting via mwaichatbot Shortcode id Parameter vulnerability discovered by mikemyers in WordPress Plugin AI Engine versions = 2.8.4...
CVE-2025-24735
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Stored XSS. This issue affects Chatra Live Chat + ChatBot + Cart Saver: from n/a through 1.0.11...
CVE-2025-24735
CVE-2025-24735 concerns the WordPress plugin Chatra Live Chat + ChatBot + Cart Saver (<= 1.0.11). The vulnerability is an improper input neutralization that enables Stored Cross-Site Scripting during web page generation. The CVSS v3.1 base score is 7.7 (HIGH) with network attack vector, low at...
CVE-2025-24735: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Chatra Chatra Live Chat + ChatBot + Cart Saver allows Stored XSS. This issue affects Chatra Live Chat + ChatBot + Cart Saver: from n/a through 1.0.11...
WordPress plugin Chatra Live Chat + ChatBot + Cart Saver has cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2025-53200
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through = 6.7.3...
WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability
Broken Access Control Vulnerability discovered by zaim in WordPress Plugin ChatBot versions = 6.7.3...
CVE-2025-53200
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through = 6.7.3...
CVE-2025-53200
CVE-2025-53200 concerns WordPress ChatBot plugin (WPBot)
CVE-2025-53200 WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability
Missing Authorization vulnerability in QuantumCloud ChatBot chatbot allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ChatBot: from n/a through = 6.7.3...
CVE-2025-53200 WordPress ChatBot plugin <= 6.7.3 - Broken Access Control Vulnerability
Missing Authorization vulnerability in QuantumCloud ChatBot allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ChatBot: from n/a through 6.7.3...