https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 17:06:56 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-14933 <p>Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker&#39;s co-browsing session, via content of the co-browsed page that the agent&#39;s browser renders as HTML.</p> <p>The JavaScript runs in the context and under the identity of the agent&#39;s session in the Agent Desk or the Single Conversation Desk.</p> <p>Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn&#39;t affected.</p> <p>Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker&#39;s co-browsing session, via content of the co-browsed page that the agent&#39;s browser renders as HTML.</p> <p>The JavaScript runs in the context and under the identity of the agent&#39;s session in the Agent Desk or the Single Conversation Desk.</p> <p>Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn&#39;t affected.</p> https://db.gcve.eu/vuln/fkie_cve-2026-14933 https://db.gcve.eu/vuln/ghsa-9p8h-2662-3xvr <p>Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker&#39;s co-browsing session, via content of the co-browsed page that the agent&#39;s browser renders as HTML.</p> <p>The JavaScript runs in the context and under the identity of the agent&#39;s session in the Agent Desk or the Single Conversation Desk.</p> <p>Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn&#39;t affected.</p> <p>Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker&#39;s co-browsing session, via content of the co-browsed page that the agent&#39;s browser renders as HTML.</p> <p>The JavaScript runs in the context and under the identity of the agent&#39;s session in the Agent Desk or the Single Conversation Desk.</p> <p>Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn&#39;t affected.</p> https://db.gcve.eu/vuln/ghsa-9p8h-2662-3xvr