Stored Cross-Site Scripting (XSS) in Tallos Chat by RD Station Conversas
Tallos Chat.
INCIBE has coordinated the disclosure of a medium-severity vulnerability affecting Tallos Chat by RD Station Conversas, a professional tool for customer service and sales via chat. The vulnerability was discovered by Leopoldo Angulo Gallego.
This vulnerability has been assigned the following code, CVSS v4.0 base score, CVSS vector, and CWE vulnerability type:
- CVE-2026-4765: CVSS v4.0: 5.1 | CVSS AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N | CWE-79
No solution has been reported yet.
CVE-2026-4765: stored Cross-Site Scripting (XSS) vulnerability in the RD Station Conversas chat. The vulnerability resides in the ‘name’ parameter of the initialization process due to improper sanitization of user input. The vulnerability is not limited to self-exploitation: when a support agent joins the conversation, the malicious script also executes in their browser, increasing the impact. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code within the context of the application.
| Identificador CVE | Severidad | Explotación | Fabricante |
|---|---|---|---|
| CVE-2026-4765 | Media | No | RD Station Conversas |
