PT-2026-5927 · Nice · Nice Chat

Published 2026-02-03 · Updated 2026-02-03 · CVE-2025-59902

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NICE Chat (affected versions not specified)

Description An HTML injection issue exists in NICE Chat. The issue allows an attacker to inject and display arbitrary HTML content within email transcripts. This is achieved by manipulating the firstName and lastName parameters during a chat session. The injected HTML appears in the email body sent by the system, potentially enabling phishing attacks, impersonation, or credential theft.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-59902

Affected Products

Nice Chat

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-59902 · Security Note
• https://t.me/cveNotify/150708 · Telegram Post
• https://incibe.es/en/incibe-cert/notices/aviso/html-injection-nice-chat · Note
• https://t.me/CVEtracker/43591 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2018681377395253722 · Twitter Post