CVE-2025-0742

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILEID" of the endpoint "/embedai/files/show/"...

CVE-2025-0742

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILEID" of the endpoint "/embedai/files/show/"...

CVE-2025-0744

an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmtcashondelivery/pay" endpoint...

CVE-2025-0744

an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmtcashondelivery/pay" endpoint...

CVE-2025-0745

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the "/embedai/app/uploads/database/" endpoint...

CVE-2025-0745 Improper Access Control vulnerability in EmbedAI

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the "/embedai/app/uploads/database/" endpoint...

CVE-2025-0745 Improper Access Control vulnerability in EmbedAI

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the "/embedai/app/uploads/database/" endpoint...

CVE-2025-0745

CVE-2025-0745 affects EmbedAI 2.1 and earlier. The issue is inadequate access control that allows an authenticated attacker to retrieve database backups by requesting the endpoint /embedai/app/uploads/database/. This can lead to exposure of sensitive data stored in backups. The connected PT-2025-...

CVE-2025-0744 Improper Access Control vulnerability in EmbedAI

an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmtcashondelivery/pay" endpoint...

CVE-2025-0744

EmbedAI, version 2.1 and earlier, is exposed to an Improper Access Control vulnerability. An authenticated attacker can change their subscription plan without paying by issuing a POST to the payment endpoint (/demos/embedai/pmt_cash_on_delivery/pay or with spacing as described in sources). Root c...

CVE-2025-0743

CVE-2025-0743 affects EmbedAI 2.1 and earlier. Affected component: the /embedai/visits/show/ endpoints, whose access control is insufficient, allowing an authenticated attacker to obtain information about other users’ visits (IP address, user agent, and location). This is described across multipl...

CVE-2025-0740

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHATID” of the endpoint "/embedai/chats/loadmessages?chatid="...

CVE-2025-0739

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTIONID" param of the endpoint "/demos/embedai/subscriptions/show/"...

CVE-2025-0739

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTIONID" param of the endpoint "/demos/embedai/subscriptions/show/"...

CVE-2025-0740

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHATID” of the endpoint "/embedai/chats/loadmessages?chatid="...

CVE-2025-0741

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chatid" of the POST request "/embedai/chats/sendmessage"...

CVE-2025-0741

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chatid" of the POST request "/embedai/chats/sendmessage"...

CVE-2025-0742

CVE-2025-0742 describes an Improper Access Control vulnerability in EmbedAI 2.1 and earlier. An authenticated attacker can access other users’ files by altering the FILE_ID in the endpoint /embedai/files/show/, exposing confidential data and reducing confidentiality. Reported impact in sources in...

CVE-2025-0742 Improper Access Control vulnerability in EmbedAI

An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILEID" of the endpoint "/embedai/files/show/"...

CVE-2025-0741

EmbedAI versions 2.1 and below are affected by an improper access control vulnerability that lets an authenticated attacker write messages into other users’ chats by altering the chat_id parameter in the POST /embedai/chats/send_message endpoint. Affected component: EmbedAI chat messages API. Roo...