CVE-2025-58115

MediumCVSS 6.1

Published: 16/10/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

17th percentile - higher than 17% of all known CVEs

Summary

ChatLuck contains a cross-site scripting (XSS) vulnerability in the Guest User Sign-up feature. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.

Risk Assessment

An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, credential theft, or other sensitive information disclosure. The risk is high for users visiting affected pages.

Recommendation

Update ChatLuck to the latest version that fixes this vulnerability. Implement input filtering and output encoding to prevent XSS.

Other vulnerabilities in ChatLuck

CVE-2025-54461Medium
ChatLuck contains an insufficient granularity of access control vulnerability in the Invitation of Guest Users feature. If exploited, an uninvited guest user may register itself as a guest user.

Original NVD description (English source)

ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS