Vocechat
Monthly
DOM-based cross-site scripting in Privoce Vocechat up to and including 0.9.121 allows remote attackers to run script in a victim's browser by crafting a link whose `welcome` query parameter is reflected into the widget.html page. Exploitation requires the target to open the malicious URL (CVSS 4.0 UI:P, assessed vector UI:R), and impact is confined to client-side script execution rather than server compromise. VulDB reported the issue with a public PoC document reference that is not verified as working exploit code, no CISA KEV entry applies, the vendor was contacted and did not respond, and no fixed version is listed in the available sources; scoring is 5.3 with a this_month priority.
DOM-based cross-site scripting in Privoce Vocechat up to and including 0.9.121 allows remote attackers to run script in a victim's browser by crafting a link whose `welcome` query parameter is reflected into the widget.html page. Exploitation requires the target to open the malicious URL (CVSS 4.0 UI:P, assessed vector UI:R), and impact is confined to client-side script execution rather than server compromise. VulDB reported the issue with a public PoC document reference that is not verified as working exploit code, no CISA KEV entry applies, the vendor was contacted and did not respond, and no fixed version is listed in the available sources; scoring is 5.3 with a this_month priority.