CVE-2026-104808 in MiVoice Office 400
Summary
by MITRE • 10/05/2026
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application.
The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Users → Users List. The vulnerability occurs in the “Microsoft Exchange mailbox” field, which fails to properly validate or sanitize user-supplied input before storing and rendering it.
By injecting malicious JavaScript into this field, an attacker can cause the payload to execute whenever the affected user properties are accessed. This can prevent access to the affected user properties and result in a denial-of-service condition within the application's user-management functionality.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The identified vulnerability represents a stored Cross-Site Scripting flaw located within the administrative interface of DigitalCanion software, specifically accessible via TCP port 443 under the Configuration module’s Users section. This security defect is situated in the input field designated for Microsoft Exchange mailbox identifiers. The core technical failure lies in the application's insufficient validation and sanitization mechanisms when processing user-supplied data prior to persistent storage in the backend database. Unlike reflected XSS, where malicious scripts are executed immediately within a victim's browser session through crafted links, this stored variant persists on the server side. Consequently, any administrative or authorized user who subsequently views the compromised user profile will trigger the execution of the injected payload directly from the application’s rendered content.
From an operational perspective, while Cross-Site Scripting is traditionally associated with data theft or session hijacking through cookie stealing or keylogging, this specific instance manifests as a denial-of-service condition within the web application's user management functionality. The malicious JavaScript code disrupts normal page rendering and prevents legitimate users from accessing affected user properties effectively locking out administrators from managing those specific accounts. This degradation of service impacts the availability component of the CIA triad, hindering system administration tasks and potentially requiring manual database intervention to remove the malicious content if the application does not provide a self-healing mechanism for corrupted fields.
This vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting in the Common Weakness Enumeration standard. The attack vector is classified under ATT&CK technique T1059 Command and Scripting Interpreter, specifically JavaScript execution within a browser context, although the primary impact here is availability rather than command execution on the host system. The persistence of the payload means that remediation requires not only patching the input validation logic but also actively cleaning existing malicious entries from the database to restore full administrative functionality.
To mitigate this risk, developers must implement strict server-side input validation and output encoding for all user-controllable fields, particularly those rendered in HTML contexts without proper escaping. Utilizing a whitelist approach for expected mailbox formats can prevent arbitrary script injection more effectively than blacklist-based filtering which is prone to bypasses via obfuscation techniques. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby neutralizing the impact even if input validation fails. Regular security audits and penetration testing focusing on stored XSS vectors in administrative interfaces are recommended to ensure comprehensive protection against such persistent threats.