Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-0910: TransmitMail lets attacker run script via crafted filename

CVE-2015-0910 · published 11 years ago

Summary

Versions 1.0.11 through 1.5.8 of TransmitMail allow a remote user to insert malicious web code by using a specially designed file name. This can lead to stolen data or hijacked user sessions when the injected code is displayed. Update to a patched version or apply input‑validation fixes to block unsafe file names.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
dounokouno	transmitmail	1.0.11 1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.2.0 1.2.1 1.3.0 1.3.1 1.4.0 1.4.1 10 more version ranges `cpe:2.3:a:dounokouno:transmitmail:1.0.11:::::::*`

Original advisory text

Cross-site scripting (XSS) vulnerability in TAGAWA Takao TransmitMail 1.0.11 through 1.5.8 allows remote attackers to inject arbitrary web script or HTML via a crafted filename.

References

http://dounokouno.com/2015/04/20/transmitmail-%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%... Vendor Advisory
http://jvn.jp/en/jp/JVN26860747/index.html Vendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2015-000054 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.3 Medium

Exploitation

1% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published24 Apr 2015

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-0910 · NVD

Track software like this

Free during beta