CVE-2024-7204 — Ai3 QbiBot - Stored XSS

Back Back to CVE browser

MEDIUM

Ai3 QbiBot - Stored XSS

Published Aug 2, 2024

6.1

MEDIUM

CVSS 3.1

EPSS 0.33%

Description

Ai3 QbiBot does not properly filter user input, allowing unauthenticated remote attackers to insert JavaScript code into the chat box. Once the recipient views the message, they will be subject to a Stored XSS attack.

Affected products

Vendor Ai3 Product QbiBot Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <=v8.0.9.b1

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ai3

QbiBot

unaffected

Version	Status	Constraints
0	affected	<=v8.0.9.b1

Remediation

Vendor solution

Update to version 8.0.9.02 or later, or install the patch.

Metrics

0.33% 0.00332

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.00332

Score over time

2024–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (5 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	0.33% (0.00332)	24.03th	v5 (v2026.06.15)
Jun 15, 2026	0.31% (0.00313)	22.82th	v5 (v2026.06.15)
Mar 17, 2025	0.26% (0.00263)	47.75th	v4 (v2025.03.14)
Dec 12, 2024	0.05% (0.00046)	19.03th	v3 (v2023.03.01)
Aug 6, 2024	0.05% (0.00046)	17.62th	v3 (v2023.03.01)

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://www.twcert.org.tw/en/cp-139-7975-3e810-2.html
vendor-advisoryThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7969-7827e-1.html
vendor-advisoryThird Party Advisory

Link	Providers	Tags
https://www.twcert.org.tw/en/cp-139-7975-3e810-2.html		vendor-advisoryThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-7969-7827e-1.html		vendor-advisoryThird Party Advisory