CVE-2025-51864

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts through stolen JWT tokens.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jul 22, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-518658.8Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), alCVE-2025-518676.5Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with CVE-2025-518687.5Insecure Direct Object Reference (IDOR) vulnerability in Dippy (chat.dippy.ai) v2 allows attackers to gain sensitive information via the conCVE-2025-518697.5Insecure Direct Object Reference (IDOR) vulnerability in Liner thru 2025-06-03 allows attackers to gain sensitive information via crafted spCVE-2025-51876.7A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding noCVE-2025-51908.8The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect auCVE-2025-51917.3An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted pathCVE-2025-51927.5A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System thCVE-2025-51944.8The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a pageCVE-2025-51954.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-519516.1andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-519546.1playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.