Listen to this Post
How the CVE Works:
CVE-2025-49462 is a stored cross-site scripting (XSS) vulnerability in Zoom Client versions prior to 6.4.5. An authenticated attacker can inject malicious JavaScript into meeting chat messages or other user-accessible fields. When another user views the manipulated content, the script executes in their browser context, potentially allowing session hijacking, data theft, or unauthorized actions under the victim’s Zoom account. The attack requires network access and relies on insufficient input sanitization in the client’s rendering engine.
DailyCVE Form:
Platform: Zoom Client
Version: < 6.4.5
Vulnerability: Stored XSS
Severity: Medium
Date: 08/05/2025
Prediction: Patch expected by 09/15/2025
What Undercode Say:
Analytics:
nmap -sV --script zoom-vuln-check <target> curl -X POST -d "payload=<script>alert(1)</script>" http://zoom-chat-api/
Exploit:
- Craft malicious meeting chat with JavaScript payload.
- Social engineer victim to view chat.
- Harvest session cookies via injected script.
Protection from this CVE:
- Update to Zoom Client 6.4.5+.
- Disable rich-text rendering in chats.
- Apply CSP headers to mitigate XSS.
Impact:
- Unauthorized data disclosure.
- Session hijacking.
- Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
