Research shows NextChat, a popular standalone chatbot with over 7500 exposed instances, is vulnerable to a critical SSRF vulnerability (CVE-2023-49785) that allows attackers to access internal systems and data potentially. User Interface of NextChat The vulnerability was reported to the vendor in November 2023, but with no patch available after 90 days, technical details are being publicly released.

Source: GBHackers