CVE-2026-23607

🗓️ 19 Feb 2026 17:55:34Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 22 Views🌐 WEB

Stored XSS in GFI MailEssentials AI before 22.4 in Anti-Spam Whitelist; authenticated users can inject script via the txtDescription field.

Reporter	Title	Published	Views	Family All 7
cnnvd	GFI MailEssentials AI 安全漏洞	19 Feb 202600:00	–	cnnvd
cvelist	CVE-2026-23607 GFI MailEssentials AI < 22.4 Anti-Spam Whitelist Description Stored XSS	19 Feb 202617:55	–	cvelist
nvd	CVE-2026-23607	19 Feb 202618:24	–	nvd
osv	CVE-2026-23607	19 Feb 202618:24	–	osv
ptsecurity	PT-2026-20887	19 Feb 202600:00	–	ptsecurity
redhatcve	CVE-2026-23607	20 Feb 202619:40	–	redhatcve
vulnrichment	CVE-2026-23607 GFI MailEssentials AI < 22.4 Anti-Spam Whitelist Description Stored XSS	19 Feb 202617:55	–	vulnrichment

NVD

Vulners

CNA

Node

gfi mailessentialsRange<22.4

[
  {
    "defaultStatus": "unaffected",
    "product": "MailEssentials AI",
    "vendor": "GFI Software",
    "versions": [
      {
        "lessThan": "22.4",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
gfi	www.gfi.ai/products-and-solutions/network-security-solutions/mailessentials/resources/documentation/product-releases
vulncheck	www.vulncheck.com/advisories/gfi-mailessentials-ai-anti-spam-whitelist-description-stored-xss

Parameter	Position	Path	Description	CWE
ctl00$ContentPlaceHolder1$pv1$txtDescription	request body	MailEssentials/pages/MailSecurity/Whitelist.aspx	Stored cross-site scripting vulnerability in the Anti-Spam Whitelist management interface allowing HTML/JavaScript input to be stored and later rendered for authenticated users.	CWE-79

17 Jun 2026 10:21Current

5.4Medium risk

Vulners AI Score5.4

CVSS 45.1

CVSS 3.15.4

EPSS0.00173

SSVC

CWE-79