EUVD-2026-71457
GHSA-4q68-wwmh-hwrj
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N
Network-accessible web app, low-privilege auth to inject, victim interaction required to trigger; S:C reflects cross-user session impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
8DescriptionCVE.org
EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality. Improper neutralization of user-controlled input during web page generation allows authenticated attackers to execute arbitrary JavaScript in the context of other authenticated users, potentially resulting in session hijacking, account takeover, and unauthorized actions.
AnalysisAI
Stored cross-site scripting in EMX Tecnologia's Gestão X business-management suite (version 8.4 and earlier) lets an authenticated user plant malicious JavaScript inside the Help Chat feature, which then executes in the browser of any other authenticated user who opens that conversation. Successful exploitation enables session hijacking, account takeover and unauthorized actions performed under the victim's identity, with the attacker's own privileges and one victim click as the only prerequisites. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today