CVE-2026-79418 is a high severity (CVSS 8.7) stored cross site scripting flaw in the Help Chat feature of EMX Tecnologia Gestao X Business Suite, version 8.4 and earlier. An authenticated attacker can run script in the browsers of other users. We could not confirm a fixed version, so ask the vendor.
What's affected
- EMX Tecnologia Gestao X Business Suite version 8.4 and earlier, per the CVE record.
- The weak feature is the Help Chat functionality.
- Fixed version: not confirmed. The references in the record are a shared document and the vendor home page, and neither gave us a version. Ask EMX Tecnologia for the fixed release and check the vendor advisory.
Record severity: CVSS 8.7 (high), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N. The weakness class is CWE-79, Improper Neutralization of Input During Web Page Generation.
How to check if you're exposed
Find the installed version in the application, usually in the about or settings area, or ask your administrator. If it is 8.4 or earlier, treat it as affected. Then review the Help Chat for messages that contain markup or script, and check who has accounts that can post there.
What to do now
- Confirm the installed Gestao X version.
- Contact EMX Tecnologia for a fixed release and apply it when available.
- Limit Help Chat access to users who need it until a fix is in place.
- Review existing chat content for markup that does not belong, and remove it.
- Set a content security policy on the web front end if you can, and remind staff not to click unexpected prompts inside the app.
Why it matters
Stored cross site scripting (CWE-79) happens when the application saves user input and later shows it to other people without neutralizing it. The script then runs inside a trusted session of whoever opens the page. In a business suite that handles finance and customer data, a hijacked session can do what that user can do.
The CVSS score of 8.7 reflects a changed scope, since the script runs in other users contexts. The vector needs an authenticated attacker, which narrows the field to insiders and compromised accounts. The record does not mark the CVE as known exploited.
Quick check
Is there a patch?
We could not confirm one. Contact the vendor and check its advisory.
Does the attacker need an account?
Yes, the record says an authenticated attacker.
Sources
To see where this and other CVEs sit in your own dependencies, try the free in-browser scan at gold.safeguard.sh/scan.
Last reviewed: 18 October 2026.
