A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to conduct a stored cross-site scripting (XSS) attack against user interface. This exists because does not properly validate user-supplied input. An exploit this by persuading interface click crafted link. A successful execute arbitrary script code context affected or access sensitive, browser-based information. To successfully vulnerability, would need valid agent credentials.