A flaw in Cisco Webex’s input filtering permits an attacker to embed malicious JavaScript in a link. When a user opens the link, the script executes within the victim’s browser context, potentially stealing session data, defacing the interface, or compromising the client’s security. This vulnerability is a clear example of improper input validation, as indicated by its association with CWE‑79.

The vulnerability applies to Cisco Webex Meetings. No specific version range is provided, so any deployment of Webex Meetings could be affected until the vendor’s fix is applied.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% shows a very low likelihood of real‑world exploitation. The vulnerability is not listed in CISA’s KEV catalog. An unauthenticated attacker would need to persuade a user to click a malicious link; the attack vector is therefore social engineering rather than network intrusion.