Updated 10 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

343new WordPress flaws this week

390,080entries in the database

229 results · page 5 of 5

Jul 6, 2023SQL Injection vulnerability in textMessage parameter in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine v.1.0, allows attackers to gain sensitive informatCVE-2023-30325 · Other software · Chatengine Project · reported by MITREHigh 7.5
SQL Injection vulnerability in textMessage parameter in /src/chatbotapp/chatWindow.java in wliang6 ChatEngine v.1.0, allows attackers to gain sensitive information.
Product
Chatengine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com payatu.com
Jul 6, 2023SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information.CVE-2023-30323 · Other software · Chatengine Project · reported by MITREHigh 7.5
SQL Injection vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to gain sensitive information.
Product
Chatengine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com payatu.com
Jul 6, 2023Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary CVE-2023-30322 · Other software · Chatengine Project · reported by MITREMedium 5.4
Cross Site Scripting (XSS) vulnerability in username field in /src/chatbotapp/chatWindow.java in Payatu ChatEngine v.1.0, allows attackers to execute arbitrary code.
Product
Chatengine
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com payatu.com
Jun 19, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-2811 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.6 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks to all admin when setting chatbot and all client when using chatbot
Product
AI ChatBot
Fixed in
4.5.6
What to do
Update AI ChatBot to 4.5.6 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 19, 2023AI ChatBot: Does not sanitize and escape its settingsCVE-2023-2742 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.5 does not sanitize and escape its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Product
AI ChatBot
Fixed in
4.5.5
What to do
Update AI ChatBot to 4.5.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 25, 2023Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass.CVE-2023-2887 · Other software · CBOT · reported by iletisim@usom.gov.trCritical 9.8
Authentication Bypass by Spoofing vulnerability in CBOT Chatbot allows Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Product
Chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 25, 2023Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation.CVE-2023-2886 · Other software · CBOT · reported by iletisim@usom.gov.trMedium 4.3
Missing Origin Validation in WebSockets vulnerability in CBOT Chatbot allows Content Spoofing Via Application API Manipulation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Product
Chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 25, 2023Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM).CVE-2023-2885 · Other software · CBOT · reported by iletisim@usom.gov.trHigh 8.1
Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability in CBOT Chatbot allows Adversary in the Middle (AiTM). This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Product
Chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 25, 2023Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature SpoofingCVE-2023-2884 · Other software · CBOT · reported by iletisim@usom.gov.trCritical 9.8
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG), Use of Insufficiently Random Values vulnerability in CBOT Chatbot allows Signature Spoofing by Key Recreation. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Product
Chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 25, 2023Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass.CVE-2023-2883 · Other software · CBOT · reported by iletisim@usom.gov.trHigh 8.8
Authorization Bypass Through User-Controlled Key vulnerability in CBOT Chatbot allows Authentication Abuse, Authentication Bypass. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Product
Chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 25, 2023Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse.CVE-2023-2882 · Other software · CBOT · reported by iletisim@usom.gov.trCritical 9.8
Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token Impersonation, Privilege Abuse. This issue affects Chatbot: before Core: v4.0.3.4 Panel: v4.0.3.7.
Product
Chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record siberguvenlik.gov.tr usom.gov.tr
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in a function hooked to initCVE-2023-1660 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in a function hooked to init, allowing unauthenticated users to update some settings, leading to Stored XSS due to the lack of escaping when outputting them in the admin dashboard
Product
AI ChatBot
Fixed in
4.4.9
What to do
Update AI ChatBot to 4.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settingsCVE-2023-1651 · WordPress plugins & themes · reported by WPScanMedium 5.4
The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to Stored XSS
Product
AI ChatBot
Fixed in
4.4.9
What to do
Update AI ChatBot to 4.4.9 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Unserializes user input from cookies via an AJAX action available to unauthenticated usersCVE-2023-1650 · WordPress plugins & themes · reported by WPScanCritical 9.8
The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog
Product
AI ChatBot
Fixed in
4.4.7
What to do
Update AI ChatBot to 4.4.7 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Does not sanitise and escape numerous of its settingsCVE-2023-1649 · WordPress plugins & themes · reported by WPScanMedium 4.8
The AI ChatBot WordPress plugin before 4.5.1 does not sanitise and escape numerous of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Product
AI ChatBot
Fixed in
4.5.1
What to do
Update AI ChatBot to 4.5.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 8, 2023AI ChatBot: Does not escape most of its settings before outputting them back in the dashboardCVE-2023-1011 · WordPress plugins & themes · reported by WPScanMedium 6.1
The AI ChatBot WordPress plugin before 4.4.5 does not escape most of its settings before outputting them back in the dashboard, and does not have a proper CSRF check, allowing attackers to make a logged in admin set XSS payloads in them.
Product
AI ChatBot
Fixed in
4.4.5
What to do
Update AI ChatBot to 4.4.5 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Feb 23, 2023Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.CVE-2023-24415 · WordPress plugins & themes · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in QuantumCloud AI ChatBot plugin <= 4.2.8 versions.
Fixed in
4.2.9
What to do
Update the plugin to 4.2.9 or newer.
Full record and what to do →NVD record patchstack.com patchstack.com
Jul 10, 2022The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.CVE-2022-31587 · Other software · Kg-fashion-chatbot Project · reported by MITRECritical 9.3
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Product
Kg-fashion-chatbot
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_response&id=.CVE-2022-31971 · Other software · Chatbot App With Suggestion Project · reported by MITREHigh 7.2
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/view_response&id=.
Product
Chatbot App With Suggestion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_response&id=.CVE-2022-31970 · Other software · Chatbot App With Suggestion Project · reported by MITREHigh 7.2
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=responses/manage_response&id=.
Product
Chatbot App With Suggestion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.CVE-2022-31969 · Other software · Chatbot App With Suggestion Project · reported by MITRECritical 9.8
ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simple_chat_bot/admin/?page=user/manage_user&id=.
Product
Chatbot App With Suggestion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jun 2, 2022ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.CVE-2022-31966 · Other software · Chatbot App With Suggestion Project · reported by MITREMedium 6.5
ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simple_chat_bot/classes/Master.php?f=delete_img.
Product
Chatbot App With Suggestion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 24, 2022ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response.CVE-2022-30464 · Other software · Chatbot App With Suggestion Project · reported by MITREMedium 5.4
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to Cross Site Scripting (XSS) via /simple_chat_bot/classes/Master.php?f=save_response.
Product
Chatbot App With Suggestion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 24, 2022ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id.CVE-2022-30459 · Other software · Chatbot App With Suggestion Project · reported by MITREHigh 8.8
ChatBot App with Suggestion in PHP/OOP v1.0 is vulnerable to SQL Injection via /simple_chat_bot/classes/Master.php?f=delete_response, id.
Product
Chatbot App With Suggestion
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
May 20, 2022ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responsCVE-2022-30518 · Other software · Chatbot Application With A Suggestion Feature Project · reported by MITRECritical 9.8
ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responses/view_response.php.
Product
Chatbot Application With A Suggestion Feature
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cxsecurity.com packetstormsecurity.com
Dec 19, 2021Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file typCVE-2021-44164 · Other software · Chain Sea Information Integration Co., Ltd · reported by twcert@cert.org.twCritical 9.8
Chain Sea ai chatbot system’s file upload function has insufficient filtering for special characters in URLs, which allows a remote attacker to by-pass file type validation, upload malicious script and execute arbitrary code without authentication, in order to take control of the system or terminate service.
Product
ai chatbot system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 19, 2021Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for CVE-2021-44163 · Other software · Chain Sea Information Integration Co., Ltd · reported by twcert@cert.org.twMedium 6.1
Chain Sea ai chatbot backend has improper filtering of special characters in URL parameters, which allows a remote attacker to perform JavaScript injection for XSS (reflected Cross-site scripting) attack without authentication.
Product
ai chatbot system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Dec 19, 2021Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability.CVE-2021-44162 · Other software · Chain Sea Information Integration Co., Ltd · reported by twcert@cert.org.twHigh 7.5
Chain Sea ai chatbot system’s specific file download function has path traversal vulnerability. The function has improper filtering of special characters in URL parameters, which allows a remote attacker to download arbitrary system files without authentication.
Product
ai chatbot system
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record twcert.org.tw twcert.org.tw
Mar 29, 2021Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feCVE-2021-29267 · Other software · Sherlockim · reported by MITREMedium 6.1
Sherlock SherlockIM through 2021-03-29 allows Cross Site Scripting (XSS) by leveraging the api/Files/Attachment URI to attack help-desk staff via the chatbot feature.
Product
Sherlockim
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com sherlockim.ae

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.