Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| RD Station Conversas | Tallos Chat | unaffected |
|
No data.
No data.
| Vendor | Product | Confidence | Versions | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
| Rd Station Conversas | Tallos Chat | 95% |
|
Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 09 Sep 2026 12:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the conversation, the malicious script also executes in their browser, increasing the impact. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code within the context of the application. | Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which is executed within the context of the user’s own session who provides the payload. The demonstrated impact is limited to the user who enters and executes the payload. |
| Title | Stored Cross-Site Scripting (XSS) in Tallos Chat by RD Station Conversas | Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas |
| Metrics |
cvssV4_0
|
cvssV4_0
|
Mon, 13 Jul 2026 14:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Mon, 13 Jul 2026 11:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the conversation, the malicious script also executes in their browser, increasing the impact. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code within the context of the application. | |
| Title | Stored Cross-Site Scripting (XSS) in Tallos Chat by RD Station Conversas | |
| First Time appeared |
Rd Station Conversas
Rd Station Conversas tallos Chat |
|
| Weaknesses | CWE-79 | |
| CPEs | cpe:2.3:a:rd_station_conversas:tallos_chat:all_versions:*:android:*:*:*:*:* cpe:2.3:a:rd_station_conversas:tallos_chat:all_versions:*:ios:*:*:*:*:* cpe:2.3:a:rd_station_conversas:tallos_chat:all_versions:*:linux:*:*:*:*:* cpe:2.3:a:rd_station_conversas:tallos_chat:all_versions:*:macos:*:*:*:*:* cpe:2.3:a:rd_station_conversas:tallos_chat:all_versions:*:windows:*:*:*:*:* |
|
| Vendors & Products |
Rd Station Conversas
Rd Station Conversas tallos Chat |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: INCIBE
Published:
Updated: 2026-09-09T11:55:38.262Z
Reserved: 2026-03-24T11:45:47.723Z
Link: CVE-2026-4765
Vulnrichment
Updated: 2026-07-13T13:14:14.954Z
NVD
Status : Deferred
Published: 2026-07-13T11:16:27.450
Modified: 2026-09-09T12:17:12.220
Link: CVE-2026-4765
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-10T05:00:09Z
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')