Back to overview

CVE-2026-4765

MEDIUM
5.1
CVSS 4.0
Description
Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the conversation, the malicious script also executes in their browser, increasing the impact. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code within the context of the application.

Metadata

CVE ID
CVE-2026-4765
State
PUBLISHED
Assigner
INCIBE
Reserved
2026-03-24 11:45 UTC
Published
2026-07-13 10:16 UTC
Last updated
2026-07-13 13:14 UTC
Primary CWE
CWE-79
CWE-79 Improper neutralization of input during web page gene…
Vendor / Product
RD Station Conversas / Tallos Chat
Sources
cve.org  ·  NVD

Severity & Metrics

5.1 MEDIUM CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
partial
Affected products (1)
VendorProductPlatformVersions
RD Station Conversas Tallos Chat Windows,MacOS,Linux,Android,iOS all versions
Weakness (CWE)
CWESourceDescription
CWE-79 cna CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.1 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
References (1)
Back to overview