PatchTheCVE: embedaihttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2025-0747: A Stored Cross-Site Scripting vulnerability has been found in EmbedAIhttps://patchthecve.com/cve/CVE-2025-0747.htmlhttps://patchthecve.com/cve/CVE-2025-0747.htmlWed, 17 Jun 2026 08:27:05 +0000HIGH 8.6: A Stored Cross-Site Scripting vulnerability has been found in EmbedAI. This vulnerability allows an authenticated attacker to inject a malicious JavaScript code into a message that will be executed when a user opens the chat.CVE-2025-0746: A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0746.htmlhttps://patchthecve.com/cve/CVE-2025-0746.htmlWed, 17 Jun 2026 08:27:05 +0000MEDIUM 6.1: A Reflected Cross-Site Scripting vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to craft a malicious URL leveraging the"/embedai/users/show/<SCRIPT>" endpoint to inject the malicious JavaScript code. This JavaScript code will be executed whCVE-2025-0745: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0745.htmlhttps://patchthecve.com/cve/CVE-2025-0745.htmlWed, 17 Jun 2026 08:27:04 +0000HIGH 7.5: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain the backups of the database by requesting the "/embedai/app/uploads/database/<SQL_FILE>" endpoint.CVE-2025-0744: an Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0744.htmlhttps://patchthecve.com/cve/CVE-2025-0744.htmlWed, 17 Jun 2026 08:27:04 +0000HIGH 7.5: an Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker change his subscription plan without paying by making a POST request changing the parameters of the "/demos/embedai/pmt_cash_on_delivery/pay" endpoint.CVE-2025-0743: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0743.htmlhttps://patchthecve.com/cve/CVE-2025-0743.htmlWed, 17 Jun 2026 08:27:04 +0000MEDIUM 5.3: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to leverage the endpoint "/embedai/visits/show/<VISIT_ID>" to obtain information about the visits made by other users. The information provided by this endpoint incluCVE-2025-0742: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0742.htmlhttps://patchthecve.com/cve/CVE-2025-0742.htmlWed, 17 Jun 2026 08:27:04 +0000MEDIUM 5.8: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain files stored by others users by changing the "FILE_ID" of the endpoint "/embedai/files/show/<FILE_ID>".CVE-2025-0741: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0741.htmlhttps://patchthecve.com/cve/CVE-2025-0741.htmlWed, 17 Jun 2026 08:27:04 +0000MEDIUM 5.8: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to write messages into other users chat by changing the parameter "chat_id" of the POST request "/embedai/chats/send_message".CVE-2025-0740: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0740.htmlhttps://patchthecve.com/cve/CVE-2025-0740.htmlWed, 17 Jun 2026 08:27:04 +0000HIGH 8.6: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to obtain chat messages belonging to other users by changing the “CHAT_ID” of the endpoint "/embedai/chats/load_messages?chat_id=<CHAT_ID>".CVE-2025-0739: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and belowhttps://patchthecve.com/cve/CVE-2025-0739.htmlhttps://patchthecve.com/cve/CVE-2025-0739.htmlWed, 17 Jun 2026 08:27:04 +0000HIGH 8.6: An Improper Access Control vulnerability has been found in EmbedAI 2.1 and below. This vulnerability allows an authenticated attacker to show subscription's information of others users by changing the "SUSCBRIPTION_ID" param of the endpoint "/demos/embedai/subscriptions/show/<SUSCBRIPTION_ID>".