CVE-2025-11952

MITTEL 6.1CVE-2025-11952 · Published 22/10/2025 · updated 08/10/2026

Kurz gesagt

CVE-2025-11952 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in chatbot (oct8ne).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.19%, höher als bei 9.2% aller Schwachstellen.
Noch keine gepatchte Version bekannt: Herstellerhinweise unter Referenzen verfolgen.

Package	Affected versions	Patched versions
chatbot oct8ne	`= 2.3`	No fix yet

Description

Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.

References

incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-oct8ne-chatbot · Third Party Advisory

Weitere Schwachstellen in chatbot

Alle anzeigen →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free