PT-2026-20890 · Gfi · Gfi Mailessentials

Alex Williams + 1 · Publicado 2026-02-19 · Atualizado 2026-02-23 · CVE-2026-23610

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description GFI MailEssentials AI versions before 22.4 have a stored cross-site scripting issue in the POP2Exchange configuration. A logged-in user can inject HTML or JavaScript into the POP3 server login field within the JSON popServers payload sent to the /MailEssentials/pages/MailSecurity/POP2Exchange.aspx/Save API endpoint. This injected code is then saved and displayed in the management interface, leading to script execution within the user's session.

Recommendations Update GFI MailEssentials AI to version 22.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-23610

Produtos afetados

Gfi Mailessentials

Referências · 7

• https://gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases · Correção
• https://twitter.com/CVEnew/status/2025892034842595398 · Publicação no Twitter
• https://vulncheck.com/advisories/gfi-mailessentials-ai-pop2exchange-pop3-server-login-stored-xss · Nota
• https://twitter.com/VulmonFeeds/status/2024640445125480837 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23610 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23610 · Nota de Segurança
• https://t.me/CVEtracker/45152 · Publicação no Telegram