CVE-2026-23612
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$TXB_IPs parameter to /MailEssentials/pages/MailSecurity/ipdnsblocklist.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
- Score
- CVSS 3.1 5.4 Medium
- Status
- Analyzed - disclosure@vulncheck.com
- Published
- 2026-02-19
- Last modified
- 2026-05-14
- Weaknesses
- CWE-79
Affected products
References
- https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases
- https://www.vulncheck.com/advisories/gfi-mailessentials-ai-anti-spam-ip-dns-blocklist-domain-stored-xss
