CVE-2025-11952

MediumCVSS 6.1

Published: 22/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

Oct8ne Chatbot v2.3 has a Stored XSS vulnerability that allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.

Risk Assessment

An attacker can steal user session data, hijack accounts, or perform unauthorized actions, potentially leading to security and privacy breaches.

Recommendation

It is recommended to update Oct8ne Chatbot to the latest version that includes a fix for the XSS vulnerability, and restrict access to the transcript sending functionality.

Other vulnerabilities in Oct8ne Chatbot

CVE-2025-10869Medium
Oct8ne Chatbot v2.3 contains a Stored Cross-site Scripting (XSS) vulnerability. An attacker can execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript sent by email. This can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user via /Data/SaveInteractions.

Original NVD description (English source)

Stored Cross-site Scripting (XSS) in Oct8ne Chatbot v2.3. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting a malicious payload through the creation of a transcript that is sent by email. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user, through /Records/SendSummaryMail.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS