CVE-2025-53858
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.
Risk Assessment
An attacker can execute a malicious script in the user's browser, potentially leading to data theft, session hijacking, or other harmful actions.
Recommendation
Update ChatLuck to the latest version that includes security fixes. Additionally, follow secure coding practices such as output escaping.
Other vulnerabilities in ChatLuck
See all- CVE-2025-58115Medium
ChatLuck contains a cross-site scripting (XSS) vulnerability in the Guest User Sign-up feature. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.
- CVE-2025-54461Medium
ChatLuck contains an insufficient granularity of access control vulnerability in the Invitation of Guest Users feature. If exploited, an uninvited guest user may register itself as a guest user.
Original NVD description (English source)
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS