CVE-2025-58115
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk17th percentile - higher than 17% of all known CVEs
Summary
ChatLuck contains a cross-site scripting (XSS) vulnerability in the Guest User Sign-up feature. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, credential theft, or other sensitive information disclosure. The risk is high for users visiting affected pages.
Recommendation
Update ChatLuck to the latest version that fixes this vulnerability. Implement input filtering and output encoding to prevent XSS.
Other vulnerabilities in ChatLuck
See all- CVE-2025-54461Medium
ChatLuck contains an insufficient granularity of access control vulnerability in the Invitation of Guest Users feature. If exploited, an uninvited guest user may register itself as a guest user.
- CVE-2025-53858Medium
ChatLuck contains a cross-site scripting vulnerability in Chat Rooms. If exploited, an arbitrary script may be executed in the web browser of the user accessing the product.
Original NVD description (English source)
ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS