{"vulnerability": "cve-2020-15948", "sightings": [{"uuid": "d44270a7-0dc1-4336-a5a7-73fde95ef55a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15948", "type": "seen", "source": "https://t.me/hacking_Attack/18075", "content": "Exploit Collector\neGain Chat 15.5.5 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png \neGain Chat version 15.5.5 suffers from a cross site scripting vulnerability.\n\nMD5 | 8f713683de3e61e3153e8052e40aa17b\n\nDownload\n# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting\n# Vendor Homepage: https://www.egain.com/\n# Software Link: https://www.egain.com/chat-software/\n# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)\n# CVE: CVE-2020-15948\n\n# Timeline\n\n- June 2020:     Initial vulnerability discovery\n- July 2020:     Reported to eGain Corporation\n- August 2020:     Fix/patch provided by eGain Corporation\n- September 2020:   Public disclosure notified to eGain Corporation\n- July 2021:     Published CVE-2020-15948\n\n# 1. Introduction\n\neGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.\n\n# 2. Vulnerability Details\n\neGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).\n\nThe \u201cName\u201d input field (full_name) does not fully sanitise user input for special characters such as \u201c<\u201d\u201d and HTML attributes such as \u201c\u201d. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.\n\n# 3. Proof of Concept\n\nThe \u201cName\u201d input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.\n\nPayload - click\n\n# 4. Remediation\n\nApply the latest fix/patch from eGain Corporation.\n\n# 5. Credits\n\n- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)\n- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796", "creation_timestamp": "2026-09-01T20:02:30.614999Z"}, {"uuid": "100c1ec0-d23c-4587-aa2e-bd99fa1215e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-15948", "type": "seen", "source": "https://t.me/hacking_Attack/18075", "content": "Exploit Collector\neGain Chat 15.5.5 Cross Site Scripting\n\nhttps://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png \neGain Chat version 15.5.5 suffers from a cross site scripting vulnerability.\n\nMD5 | 8f713683de3e61e3153e8052e40aa17b\n\nDownload\n# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting\n# Vendor Homepage: https://www.egain.com/\n# Software Link: https://www.egain.com/chat-software/\n# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)\n# CVE: CVE-2020-15948\n\n# Timeline\n\n- June 2020:     Initial vulnerability discovery\n- July 2020:     Reported to eGain Corporation\n- August 2020:     Fix/patch provided by eGain Corporation\n- September 2020:   Public disclosure notified to eGain Corporation\n- July 2021:     Published CVE-2020-15948\n\n# 1. Introduction\n\neGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.\n\n# 2. Vulnerability Details\n\neGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).\n\nThe \u201cName\u201d input field (full_name) does not fully sanitise user input for special characters such as \u201c<\u201d\u201d and HTML attributes such as \u201c\u201d. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.\n\n# 3. Proof of Concept\n\nThe \u201cName\u201d input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.\n\nPayload - click\n\n# 4. Remediation\n\nApply the latest fix/patch from eGain Corporation.\n\n# 5. Credits\n\n- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)\n- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)\n\nSource:packetstormsecurity.com\n\u2796 Sent by @TheFeedReaderBot \u2796", "creation_timestamp": "2026-09-02T01:03:05.242318Z"}]}