CVE-2020-13972

PoC —

CVSS 3.1

6.1 medium

EPSS

<1%p51

Published

Sep 3, 2020 (Sep 3, 2020)

Modified

Jun 17, 2026

Description

Enghouse Web Chat 6.2.284.34 allows XSS. When one enters their own domain name in the WebServiceLocation parameter, the response from the POST request is displayed, and any JavaScript returned from the external server is executed in the browser. This is related to CVE-2019-16951.

Vendors: enghouse
Products: web chat
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.