PT-2026-5927 · Nice · Nice Chat

Publicado 2026-02-03 · Atualizado 2026-02-03 · CVE-2025-59902

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NICE Chat (affected versions not specified)

Description An HTML injection issue exists in NICE Chat. The issue allows an attacker to inject and display arbitrary HTML content within email transcripts. This is achieved by manipulating the firstName and lastName parameters during a chat session. The injected HTML appears in the email body sent by the system, potentially enabling phishing attacks, impersonation, or credential theft.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2025-59902

Produtos afetados

Nice Chat

Referências · 5

• https://t.me/cveNotify/150708 · Publicação no Telegram
• https://incibe.es/en/incibe-cert/notices/aviso/html-injection-nice-chat · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-59902 · Nota de Segurança
• https://t.me/CVEtracker/43591 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2018681377395253722 · Publicação no Twitter