Stored Cross-site Scripting in Oct8ne Chatbot by Oct8ne
CVE-2025-10869

5.3MEDIUM

Key Information:

Vendor

Oct8ne

Status
Chatbot
Vendor
CVE Published:
15 October 2025

What is CVE-2025-10869?

A stored cross-site scripting (XSS) vulnerability exists in Oct8ne Chatbot v2.3, allowing attackers to inject malicious JavaScript code. By manipulating transcripts that are sent via email, an attacker can execute this code in the context of the victim's browser. This exploitation can facilitate the theft of sensitive information, including session cookies, and allow unauthorized actions on behalf of the victim, posing a significant risk to user privacy and security.

Affected Version(s)

Chatbot 2.3

References

https://www.incibe.es/en/incibe-cert/notices/aviso/stored...

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Javier Hernández
José Manuel Jerónimo
JSON
.
CVE-2025-10869 : Stored Cross-site Scripting in Oct8ne Chatbot by Oct8ne