CVE-2024-48142

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A prompt injection vulnerability in the chatbox of Butterfly Effect Limited Monica ChatGPT AI Assistant v2.4.0 allows attackers to access and exfiltrate all previous and subsequent chat data between the user and the AI assistant via a crafted message.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-481439.1A lack of rate limiting in the OTP validation component of Digitory Multi Channel Integrated POS v1.0 allows attackers to gain access to the CVE-2024-481449.1A prompt injection vulnerability in the chatbox of Fusion Chat Chat AI Assistant Ask Me Anything v1.2.4.0 allows attackers to access and exf CVE-2024-481459.1A prompt injection vulnerability in the chatbox of Netangular Technologies ChatNet AI Version v1.0 allows attackers to access and exfiltrate CVE-2024-48159.8A vulnerability, which was classified as critical, has been found in Ruijie RG-UAC up to 20240506. Affected by this issue is some unknown fu CVE-2024-481509.8D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the sub_451208 function.CVE-2024-481539.8DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the CVE-2024-48169.8A vulnerability, which was classified as critical, was found in Ruijie RG-UAC up to 20240506. This affects an unknown part of the file /view CVE-2024-481689.8A stack overflow vulnerability exists in the sub_402280 function of the HNAP service of D-Link DCS-960L 1.09, allowing an attacker to execut CVE-2024-48178.8A vulnerability has been found in Campcodes Online Laundry Management System 1.0 and classified as critical. This vulnerability affects unkn CVE-2024-481705.4PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via a crafted payload injected into the name in the profile.php.CVE-2024-481769.8Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code w CVE-2024-481778.8MRCMS 3.1.2 contains a SQL injection vulnerability via the RID parameter in /admin/article/delete.do.