Monitor vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.1
GFI MailEssentials AI: Stored Cross-Site Scripting Risk
CVE-2026-23617
Summary
GFI MailEssentials AI versions before 22.4 have a security weakness that allows an attacker to inject malicious code into the management interface. This could let an attacker take control of a logged-in user's session. Users should update to version 22.4 or later to fix this issue.
What to do
No fix is available yet. Check with your software vendor for updates.
Affected software
| Vendor | Product | Affected versions | Fix available |
|---|---|---|---|
| gfi | mailessentials | <= 22.4 | – |
Original title
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An authenticated user can supply HTML/Java...
Original description
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pvGeneral$TXB_Condition parameter to /MailEssentials/pages/MailSecurity/ASKeywordChecking.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
nvd CVSS3.1
5.4
nvd CVSS4.0
5.1
Vulnerability type
CWE-79
Cross-site Scripting (XSS)
Published: 19 Feb 2026 · Updated: 11 Mar 2026 · First seen: 6 Mar 2026