CVE-2025-10869

MediumCVSS 6.1

Published: 15/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

Oct8ne Chatbot v2.3 contains a Stored Cross-site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript sent by email. This can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user via /Data/SaveInteractions.

Risk Assessment

An attacker can steal sensitive user data, such as session cookies, or perform actions on behalf of the user, potentially leading to account takeover or unauthorized operations.

Recommendation

Update Oct8ne Chatbot to the latest version that includes security fixes. Additionally, sanitize input and apply output escaping in transcript functions.

Other vulnerabilities in Oct8ne Chatbot

CVE-2025-11952Medium
Oct8ne Chatbot v2.3 has a Stored XSS vulnerability that allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.

Original NVD description (English source)

Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Data/SaveInteractions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS