CVE-2026-23618: falha de média gravidade em GFI Software MailEssentials AI
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.1epss 0.2%
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Subject) conditions interface. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pvSubject$TXB_SubjectCondition parameter to /MailEssentials/pages/MailSecurity/ASKeywordChecking.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
GFI Software · MailEssentials AICVEs relacionadas — GFI Software MailEssentials AI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23621MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File EnumerationEPSS 0.3%CVE-2026-23620MEDIUMGFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File EnumerationEPSS 0.2%CVE-2026-23619MEDIUMGFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSSEPSS 0.2%CVE-2026-23617MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSSEPSS 0.2%CVE-2026-23616MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSSEPSS 0.2%CVE-2026-23614MEDIUMGFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework IP Exceptions Description Stored XSSEPSS 0.2%