CVE-2026-116047

Privoce Vocechat Query Parameter widget.html cross site scripting

View on CVE.org
Published Oct 25, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Analysis

AI-generated

Technical impact

The vulnerability is a reflected cross‑site scripting flaw in the widget.html component of Privoce Vocechat up to version 0.9.121. By manipulating the query parameter ‘welcome’, an attacker can inject arbitrary JavaScript that executes in the victim’s browser. This can lead to credential theft, session hijacking, defacement, or redirection. The weakness is categorized as CWE‑79 and CWE‑94.

Affected Systems

Affected systems are deployments of Privoce Vocechat version 0.9.121 or earlier. The flaw resides in the Query Parameter Handler that processes widget.html; any instance of the product that parses the ‘welcome’ argument is susceptible. No other vendors or products are listed.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity, and the EPSS score is not available. The vulnerability is publicly disclosed, can be exploited remotely, and the vendor has not provided a fix or response. Without a patch, attackers can launch the XSS attack from any location that can craft the malicious URL, making the risk moderate to high for exposed installations.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to a version later than 0.9.121 once it becomes available from Privoce
  • Implement proper input validation or sanitization for the ‘welcome’ query parameter to remove any script content
  • Deploy a Content Security Policy that restricts inline script execution and external script sources to mitigate reflected XSS

Generated by OpenCVE AI on October 25, 2026 at 11:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Privoce vocechat Server
Vendors & Products Privoce vocechat Server
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Title Privoce Vocechat Query Parameter widget.html cross site scripting
First Time appeared Privoce
Privoce vocechat
Weaknesses CWE-79
CWE-94
CPEs cpe:2.3:a:privoce:vocechat:*:*:*:*:*:*:*:*
Vendors & Products Privoce
Privoce vocechat
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}
Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Oct 29, 2026, 7:46 PM
Reserved
Oct 24, 2026, 2:00 PM

View source JSON

Updated
Oct 29, 2026, 7:46 PM

JSON

Status
Deferred
Published
Oct 25, 2026, 8:16 AM
Modified
Oct 29, 2026, 8:17 PM

View source JSON

No data.

Updated
Nov 3, 2026, 4:15 PM

JSON