CVE-2026-23610
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint. An authenticated user can supply HTML/JavaScript in the POP3 server login field within the JSON \"popServers\" payload to /MailEssentials/pages/MailSecurity/POP2Exchange.aspx/Save, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Analyzed - disclosure@vulncheck.com
- Published
- 2026-02-19
- Last modified
- 2026-05-14
- Weaknesses
- CWE-79
Affected products
References
- https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases
- https://www.vulncheck.com/advisories/gfi-mailessentials-ai-pop2exchange-pop3-server-login-stored-xss
