Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 10

Export CSV
CVE-2026-112333

GFI Archiver < 15.14 Stored XSS via MailInsights.aspx

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Gfi Archiver Gfi Archiver
CVE-2026-48539

GFI Archiver < 15.14 Stored XSS via MailInsights.aspx

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48530

GFI Archiver < 15.14 Stored XSS via CategorizationPolicyWizard.aspx

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48538

GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48537

GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48536

GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48535

GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48534

GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48532

GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver
CVE-2026-48531

GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx

GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Retention and Spam Policies page.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Gfi Gfi Software
Products
Archiver Gfi Archiver