CVE-2026-104807

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Office 400 (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) issue allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The flaw is located in the web portal on TCP port 443, specifically within the Description field under Configuration → Domains. The application does not properly validate or sanitize user input before storing and rendering it. An attacker can use this to modify page content and behavior for other users, potentially altering the interface or creating phishing scenarios within the trusted context of the application.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Description field in the Configuration → Domains section until the issue is resolved.