CVE-2026-116047
Privoce Vocechat Query Parameter widget.html cross site scripting
Fetching some sources has been requested. Reload in about a minute to see them.
CVSS v3.1 (listed by NVD)
4.3
MEDIUM
Scored by vuldb.com (not yet scored by NVD)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVSS v4.0 (listed by NVD)
2.1
LOW
Scored by vuldb.com (not yet scored by NVD)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS (listed by CVE.org)
5.3
MEDIUM
Scored by CNA (VulDB) · v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS exploit probability
—
Not computed
CISA KEV
—
Not listed
Attack conditions and impact
Derived from the CNA (via NVD) CVSS 3.1 vector
NetworkNo authUser action
PoC
Confidentiality NIntegrity LAvailability N
| Metric | Value | Meaning |
|---|---|---|
| Attack vector AV | N | Network |
| Attack complexity AC | L | Low (easy) |
| Privileges required PR | N | None |
| User interaction UI | R | Required |
| Scope S | U | Unchanged |
| Confidentiality C | N | None |
| Integrity I | L | Low |
| Availability A | N | None |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
NVD
A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS assessments
| Provider | Version | Score | Vector |
|---|---|---|---|
| NVD / [email protected] (Secondary) | 4.0 | 2.1 LOW | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD / [email protected] (Primary) | 3.1 | 4.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N |
| NVD / [email protected] (Secondary) | 2.0 | 5.0 MEDIUM | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| CNA / VulDB | 4.0 | 5.3 MEDIUM | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA / VulDB | 3.1 | 4.3 MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 3.0 | 4.3 MEDIUM | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C |
| CNA / VulDB | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:C |
Affected products and packages
CNA (CVE.org)
| Vendor | Product | Versions |
|---|---|---|
| Privoce | Vocechat | affected: 0.9.121 |
Linux distribution status
References (5)
- https://github.com/H1ck1y/Vulnerabilities/blob/main/Vocechat_DomXss.md NVD, CNA exploit
- https://vuldb.com/cve/CVE-2026-116047 NVD, CNA third-party-advisory
- https://vuldb.com/submit/994199 NVD, CNA third-party-advisory
- https://vuldb.com/vuln/426123 NVD, CNA vdb-entrytechnical-description
- https://vuldb.com/vuln/426123/cti NVD, CNA signaturepermissions-required