Vulnerabilities
Summary — last 7 days
New vulnerabilities2,635▼ 214 vs. last week
Critical / high1,385▲ 153 vs. last week
New active exploitation (KEV)7▼ 3 vs. last week
Unscored (no CVSS)56▼ 473 vs. last week
8 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Deferred | Critical (9.3) | 1.9% | — | FlashchatAI | 7/31/2025 | 6/16/2026 | An unauthenticated arbitrary file upload vulnerability exists in FlashChat versions 6.0.2 and 6.0.4 through 6.0.8. The upload.php endpoint fails to properly validate file types and authentication, allowing attackers to upload malicious PHP scripts. Once uploaded, these scripts can be executed remotely, resulting in… | |
| Modified | High (7.5) | 2.8% | — | Tufat Flashchat | 5/7/2009 | 6/16/2026 | connection.php in FlashChat 5.0.8 allows remote attackers to bypass the role filter mechanism and gain administrative privileges by setting the s parameter to "7." | |
| Modified | Medium (6.8) | 0.99% | — | 123flashchat Echat Plugin | 2/10/2009 | 6/16/2026 | SQL injection vulnerability in e107chat.php in the eChat plugin 4.2 for e107, when magic_quotes_gpc is disabled, allows remote attackers to execute arbitrary SQL commands via the nick parameter. | |
| Modified | High (10) | 3.6% | — | 123flashchat 123 Flash Chat ModuleE107 | 4/27/2008 | 6/16/2026 | PHP remote file inclusion vulnerability in 123flashchat.php in the 123 Flash Chat 6.8.0 module for e107, when register_globals is enabled, allows remote attackers to execute arbitrary PHP code via a URL in the e107path parameter. | |
| Modified | High (7.5) | 6.3% | — | Zehnet ZZ Flashchat | 10/22/2007 | 6/16/2026 | Directory traversal vulnerability in admin/inc/help.php in ZZ:FlashChat 3.1 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the file parameter. | |
| Modified | Medium (6.8) | 1.2% | — | Darrens 5-dollar Script Archive Flashchat | 2/7/2007 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in FlashChat 4.7.8 allows remote attackers to inject arbitrary web script or HTML via the user name field when the user joins a chat room, a different vulnerability than CVE-2007-0807. NOTE: the provenance of this information is unknown; the details are obtained solely from… | |
| Modified | Medium (6.8) | 1.4% | — | Darrens 5-dollar Script Archive Flashchat | 2/7/2007 | 6/16/2026 | Cross-site scripting (XSS) vulnerability in info.php in flashChat 4.7.8 allows remote attackers to inject arbitrary web script or HTML via a channel title (aka room name) that is not properly handled by the "who's online" feature. | |
| Modified | High (7.5) | 3.7% | — | Darrens 5-dollar Script Archive Flashchat | 9/6/2006 | 6/16/2026 | Multiple PHP remote file inclusion vulnerabilities in FlashChat before 4.6.2 allow remote attackers to execute arbitrary PHP code via a URL in the dir[inc] parameter in (1) inc/cmses/aedatingCMS.php, (2) inc/cmses/aedatingCMS2.php, or (3) inc/cmses/aedating4CMS.php. |