Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-14933— Unblu Spark Cross-Site Scripting in Embedded Co-Browsing

Quick assessment

Affected
Unblu inc. Unblu Spark
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Unblu Inc. 的 Unblu Spark 7.0 至 7.57.7 版本以及 8.0 至 8.39.2 版本中，其嵌入式协同浏览（co-browsing）功能存在跨站脚本（XSS）漏洞。该漏洞影响本地部署和云部署环境，允许未认证的远程攻击者（以访客角色）在参与其协同浏览会话的座席（agent）浏览器中执行任意 JavaScript 代码。攻击是通过座席浏览器将协同浏览页面的内容渲染为 HTML 而实现的。 该 JavaScript 代码将在座席的会话上下文中、并以座席在“座席工作台”（Agent Desk）

CVSS 8.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-14933

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk. Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Unblu inc. Unblu Spark 7.0 ~ 7.57.7 -

II. Public POCs for CVE-2026-14933

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-14933

请登录查看更多情报信息。

Other References for CVE-2026-14933 (1)

IV. Related Vulnerabilities

Same product: Unblu Spark
Same vendor: Unblu inc.
Same weakness: CWE-79

V. Comments for CVE-2026-14933

No comments yet

Leave a comment