CVE-2026-23610: falha de média gravidade em GFI Software MailEssentials AI
GFI MailEssentials AI < 22.4 POP2Exchange POP3 Server Login Stored XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint. An authenticated user can supply HTML/JavaScript in the POP3 server login field within the JSON \"popServers\" payload to /MailEssentials/pages/MailSecurity/POP2Exchange.aspx/Save, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
GFI Software · MailEssentials AICVEs relacionadas — GFI Software MailEssentials AI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23621MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File EnumerationEPSS 0.3%CVE-2026-23620MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File EnumerationEPSS 0.2%CVE-2026-23619MEDIUMGFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSSEPSS 0.2%CVE-2026-23618MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSSEPSS 0.2%CVE-2026-23617MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSSEPSS 0.2%CVE-2026-23616MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSSEPSS 0.2%