CVE-2025-51868

CVE-2025-51868 Vulnerability description Dippyis a popular website to chat with millions of proactive AI characters. Dippy allows users to chat with characters based on LLM, which is vulnerable to Insecure Direct Object Reference IDOR in its chat component. An attacker can exploit this IDOR to...

Malware in tinkoff-fb-app-frame-page-height-dippy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in dippy-invertor (npm)

Source: amazon-inspector e8dbed78de451c63784d37e7ae925bc4bf1288b7c4cf6e0e6fb0e7f9ff4cd451 On require'dippy-invertor', index.js unconditionally loads ext.js, which downloads an OS-specific executable from four hardcoded Cloudflare Workers hosts oob-worker.cf10.workers.dev family and, on HTTPS...

Malicious Package

Overview dippy-invertor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

EUVD-2025-22156

Malicious code in bioql PyPI...

MAL-2025-36385 Malicious code in test-mlw2-swink-manly-celeb-dippy (npm)

The package test-mlw2-swink-manly-celeb-dippy was found to contain malicious code...

Malicious code in test-mlw2-swink-manly-celeb-dippy (npm)

The package test-mlw2-swink-manly-celeb-dippy was found to contain malicious code...

CVE-2025-51868

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

CVE-2025-51868

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

CVE-2025-51868: Authorization Bypass Through User-Controlled Key

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

CVE-2025-51868

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

CVE-2025-51868

An Insecure Direct Object Reference (IDOR) vulnerability exists in Dippy (chat.dippy.ai) v2 within the conversation_history endpoint. The root cause is that the server fails to validate ownership or sharing status of conversation histories, allowing attackers to access other users' data by tamper...

CVE-2025-51868

Insecure Direct Object Reference IDOR vulnerability in Dippy chat.dippy.ai v2 allows attackers to gain sensitive information via the conversationid parameter to the conversationhistory endpoint...

PT-2025-30339 · Dippy · Dippy

Name of the Vulnerable Software and Affected Versions: Dippy version 2 Description: An Insecure Direct Object Reference IDOR vulnerability exists in Dippy that allows attackers to gain sensitive information. The vulnerability is present in the conversation history API endpoint and is exploitable...

Dippy security vulnerabilities

Dippy is an AI chat site from Dippy Inc. A security vulnerability exists in Dippy version v2, which stems from improper access control of the conversationid parameter and could lead to the disclosure of sensitive information...

MAL-2022-2475 Malicious code in dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af70946fdaf395b54bd0c8aba760c2cf4f74450a051e4329e81faffc9285d74b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in dippy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in dippy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af70946fdaf395b54bd0c8aba760c2cf4f74450a051e4329e81faffc9285d74b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...