CVE-2023-24839 MEDIUM

CVE-2023-24839: HGiga MailSherlock - Reflected XSS

Vendor Hgiga
Product MailSherlock
Weakness CWE-79 · XSS
Published March 27, 2023
Last update February 19, 2025
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerability to inject JavaScript, conducting a reflected XSS attack.

Key dates

02Disclosure timeline

March 27, 2023 CVE published
February 19, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2023-23982 WordPress WPFrom Email Plugin <= 1.8.8 is vulnerable to Cross Site Scripting (XSS) CVE-2025-53533 Pi-hole Admin Interface vulnerable to cross-site scripting via malformed URL path on 404 error page CVE-2024-3989 HT Mega – Absolute Addons For Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Justify CVE-2022-44734 WordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS) CVE-2025-54880 Mermaid does not properly sanitize architecture diagram iconText leading to XSS