CVE-2026-102372mediumCWE-79

CVE-2026-102372: medium-severity vulnerability in GestSup

GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector

Published · Updated

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.3epss 0.2%
exploitation probability
0.2%top 90% of all CVEs
observed exploitation
nono source reports it
1 public exploit(s)
GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Affected products
GestSup · GestSup
public PoCs found — 1
cve_referenceblog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GestSup

In the same product, most dangerous first.

CVE-2026-100389CRITICALGestSup before 3.2.62 Remote Code Execution via IMAP AttachmentEPSS 0.6%CVE-2026-22197HIGHGestSup < 3.2.60 Multiple SQL Injections in Asset ListEPSS 0.3%CVE-2026-22196HIGHGestSup < 3.2.60 SQL Injection in Ticket CreationEPSS 0.3%CVE-2026-22195HIGHGestSup < 3.2.60 SQL Injection in Search BarEPSS 0.3%CVE-2026-22198MEDIUMGestSup < 3.2.60 Stored XSS in API Error LogsEPSS 0.3%CVE-2026-102373HIGHGestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit ParameterEPSS 0.2%
References
https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/https://gestsup.fr/index.php?page=changeloghttps://gestsup.fr/index.php?page=downloadhttps://gestsup.fr/index.php?page=download&channel=stable&version=3.2.61&type=patchhttps://www.vulncheck.com/advisories/gestsup-before-3.2.62-stored-xss-via-email-body-in-login-imap-connector