Avaya Spaces HTML Injection Vulnerability Allowing Information Disclosure and Content Modification

A vulnerability allowing HTML injection has been identified in Avaya Spaces. This issue may have led to the unauthorized disclosure of sensitive information or allowed users to modify the content of pages they viewed. The vulnerability is present in the Avaya Spaces Web Client and APIs, which are scheduled for discontinuation on September 15, 2025.

Impact

Exploitation of this vulnerability could result in unauthorized information disclosure or unintended modifications to page content, potentially misleading users or altering their experience.