CVE-2026-4765

UNKNOWN 0.0

Self Cross-Site Scripting (Self-XSS) in Tallos Chat by RD Station Conversas

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which is executed within the context of the user’s own session who provides the payload. The demonstrated impact is limited to the user who enters and executes the payload.

CWE	CWE-79
Vendor	rd station conversas
Product	tallos chat
Published	Jul 13, 2026
Last Updated	Sep 9, 2026

Stay Ahead of the Next One

Get instant alerts for rd station conversas tallos chat

Be the first to know when new unknown vulnerabilities affecting rd station conversas tallos chat are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

RD Station Conversas / Tallos Chat

all versions

References

NVD ↗ CVE.org ↗ EPSS Data ↗

incibe.es: https://www.incibe.es/en/incibe-cert/notices/aviso/stored-cross-site-scripting-xss-tallos-chat-rd-station-conversas

Credits

Leopoldo Angulo Gallego