Vulnerabilidades de Vastxie
CVEs publicadas que afetam produtos de Vastxie: 2 registro(s), com severidade, exploração e correções.
CVE-2026-111707
Média · 5.3
CWE-639 16/10/2026
99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure
99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' chat messages because querySingleChat lacks an owner check. Attackers can send a fingerprint header to obtain a visitor JWT and iterate sequential chatId values to retrieve other users' message content and task data.
CVE-2026-111706
Alta · 7.5
CWE-306 16/10/2026
99AI through 4.3.0 Unauthenticated Information Disclosure via chatLog exportExcel
99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated attackers to export all users' chat logs. Attackers can send requests with controlled page, size, and optional email fields to download xlsx files containing usernames, emails, prompts, and AI answers.