18 matches found
CVE-2025-51862
CVE-2025-51862 漏洞描述 TelegAI 是一个用于构建 AI 角色并与之聊天的 Web 应用程序，其聊天组件存在不安全的直接对象引用（IDOR）漏洞。攻击者可以利用此 IDOR 篡改其他用户的对话。此外，恶意内容和 XSS 载荷可被注入，从而导致网络钓鱼攻击、用户伪造以及通过 XSS 进行的账户劫持。 攻击向量 TelegAI 容易受到与对话 API 处理方式相关的不安全的直接对象引用（IDOR）漏洞的影响。API https://ywqesktuqvgsmgraors.supabase.co/functions/v1/chat 主要依赖请求中的 profileid...
CVE-2025-51860
CVE-2025-51860 漏洞描述 TelegAI，一个用于构建和与AI角色聊天的Web应用程序，在其聊天组件和角色容器组件中存在存储型跨站脚本（XSS）漏洞。攻击者可以通过在AI角色的描述、问候语、示例对话或系统提示（指示LLM在聊天响应中嵌入XSS负载）中构造包含SVG XSS负载的角色，从而实现任意客户端脚本执行。当用户与这种恶意AI角色交互或仅浏览其个人资料时，脚本会在用户的浏览器中执行。成功利用该漏洞可能导致敏感信息（如会话令牌）被窃取，进而可能导致账户劫持。 攻击向量...
EUVD-2025-22332
Malicious code in bioql PyPI...
EUVD-2025-22333
Malicious code in bioql PyPI...
CVE-2025-51860
Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...
CVE-2025-51862
Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...
CVE-2025-51862
Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...
CVE-2025-51860
Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...
CVE-2025-51862
Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...
PT-2025-30420 · Telegai · Telegai
Name of the Vulnerable Software and Affected Versions: TelegAI versions through 2025-05-26 Description: An Insecure Direct Object Reference IDOR vulnerability exists in the chat component of TelegAI. This allows an attacker to tamper with other users' conversations. Additionally, malicious conten...
CVE-2025-51860
Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...
CVE-2025-51860
Stored Cross-Site Scripting XSS in TelegAI telegai.com 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrary client-side script execution by crafting an AI Character with SVG XSS payloads in either description, greeting, example dialog, or system...
CVE-2025-51862
Insecure Direct Object Reference IDOR vulnerability in TelegAI telegai.com thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamper other users' conversation. Additionally, malicious contents and XSS payloads can be injected, leading to phishing attack, user spoofing and...
PT-2025-30419 · Telegai · Telegai
Name of the Vulnerable Software and Affected Versions: TelegAI affected versions not specified Description: The application contains a stored cross-site scripting XSS issue in its chat component and character container component. An attacker can execute arbitrary client-side scripts by creating a...
CVE-2025-51860
TelegAI (telegai.com) is affected by a Stored XSS (CVE-2025-51860) in its chat component and character container. The vulnerability allows an attacker to craft an AI Character with SVG XSS payloads in fields such as description, greeting, example dialog, or system prompt, causing arbitrary client...
CVE-2025-51862
TelegAI (telegai.com) is affected by an Insecure Direct Object Reference (IDOR) vulnerability in its chat component. Exploitation relies on manipulating the profile_id in chat-related API calls (as evidenced by the GitHub exploit, PT-2025-30420 description, and other reports), enabling an attacke...
TelegAI 跨站脚本漏洞
TelegAI is an AI chatbot website from TelegAI, Inc. A cross-site scripting vulnerability exists in TelegAI version 2025-05-26, which stems from an SVG cross-site scripting payload that can be embedded in AI role descriptions, leading to a stored cross-site scripting attack...
