X7 Group's vulnerability footprint centers on its X7 Chat platform, a modestly represented but more prominent-than-typical product in the landscape. The exposure recurs through a constellation of application-layer weaknesses including SQL injection, cross-site scripting, cross-site request forgery, and path-traversal flaws that reflect inadequate input sanitization and access controls in web-facing messaging functionality, and the vendor's disclosures frequently acquire public exploit code. Defenders tracking this product should prioritize input-validation and session-handling remediations; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by X7 Group over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2012-6047MEDIUM Cross-site request forgery (CSRF) vulnerability in X7 Chat 2.0.5.1 and earlier allows remote attackers to hijack the authentication of administrators for requests that add a user t | Nov 27, 2012 | 6.8 | 31 | NO | YES |
CVE-2008-4718HIGH Directory traversal vulnerability in help/mini.php in X7 Chat 2.0.1 A1 and earlier allows remote attackers to include and execute arbitrary local files via directory traversal sequ | Oct 23, 2008 | 7.5 | 29 | NO | YES |
CVE-2008-6964HIGH SQL injection vulnerability in the login page in X7 Chat 2.0.5 allows remote attackers to execute arbitrary SQL commands via the password field. | Aug 13, 2009 | 7.5 | 28 | NO | YES |
CVE-2006-3851HIGH SQL injection vulnerability in upgradev1.php in X7 Chat 2.0.4 and earlier allows remote attackers to execute arbitrary SQL commands via the old_prefix parameter. | Jul 25, 2006 | 7.5 | 28 | NO | YES |
CVE-2006-2156MEDIUM Directory traversal vulnerability in help/index.php in X7 Chat 2.0 and earlier allows remote attackers to include arbitrary files via .. (dot dot) sequences in the help_file parame | May 3, 2006 | 6.4 | 28 | NO | YES |
CVE-2008-0278MEDIUM SQL injection vulnerability in index.php in X7 Chat 2.0.5 and possibly earlier allows remote attackers to execute arbitrary SQL commands via the day parameter in a sm_window action | Jan 15, 2008 | 6.0 | 26 | NO | YES |
CVE-2007-5982MEDIUM Multiple cross-site scripting (XSS) vulnerabilities in X7 Chat 2.0.4, 2.0.5, and possibly other versions allow remote attackers to inject arbitrary web script or HTML via the (1) r | Nov 15, 2007 | 4.3 | 24 | NO | YES |
CVE-2006-2282MEDIUM Cross-site scripting (XSS) vulnerability in X7 Chat 2.0.2 and earlier allows remote attackers to inject arbitrary web script or HTML via a javascript URI in the URL of an avatar, p | May 10, 2006 | 4.3 | 14 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by X7 Group.
Media articles that mention a CVE ID that affects a product developed by X7 Group — matched by CVE ID, not by vendor name.