Live › vulnerability › CVE-2026-116047
Go to dashboardVocechat up to 0.9.121 does not properly handle the welcome query parameter in its widget.html page. A remote attacker can craft a link that runs script in a victim's browser session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 08:39 UTC. All times on this page are UTC.
Self-hosted Vocechat deployments at version 0.9.121 or earlier are exposed, since the flaw is in the widget.html page that reads the welcome parameter. Instances that do not run this version, or that do not serve widget.html, are likely not affected. The sources do not say whether a default configuration enables the page.
No product ranges from the sources yet.
0.9.1210.9.121; unknown if the sources name a fixed releaseEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
This page as .md · .json · in your agent: get_signal("CVE-2026-116047")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.