Vulnerabilidades do Vastxie 99AI
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Vastxie 99AI: 2 registro(s), com versões afetadas e correções.
CVE-2026-111707
Média · 5.3
CWE-639 16/10/2026
99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
CVE-2026-111706
Alta · 7.5
CWE-306 16/10/2026
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.