CVE-2026-112357 GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

GFI KerioConnect Kerio Connect Outlook Connector Offline Edition, 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can...

CVE-2026-112357 GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation

GFI KerioConnect Kerio Connect Outlook Connector Offline Edition, 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can...

CVE-2026-112357

GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition) , 'KOFF', versions before 10.0.9 Patch 2 is vulnerable to a local privilege escalation flaw. The root cause is weak installer permissions that allow the built-in Users group to write to the product directory. A local non-adminis...

CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112356 GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112356

GFI KerioConnect (Kerio Connect) versions prior to 10.0.9 Patch 2 are susceptible to a cross-site scripting (XSS) vulnerability within the Webmail component . The root cause is the link auto-formatter's re-processing of text already contained within a link; an attacker can use quote characters to...

GFI KerioConnect permission and access control issue vulnerability

Versions prior to GFI KerioConnect Outlook Connector Offline Edition 10.0.9 Patch 2 contain a vulnerability related to permission and access control issues. This vulnerability stems from insufficient permissions in the installer, allowing the product directory to be written to by the built-in Use...

GFI KerioConnect cross-site scripting vulnerability

Versions of GFI KerioConnect prior to 10.0.9 Patch 2 contain a cross-site scripting vulnerability. This vulnerability stems from a cross-site scripting flaw in the Webmail component. Attackers can exploit it by sending specially crafted emails; the link auto-formatter then re-processes the linked...

CVE-2026-112356: Improper Neutralization of Input During Web Page Generation

GFI KerioConnect Kerio Connect before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose te...

CVE-2026-112357: Incorrect Default Permissions

GFI KerioConnect Kerio Connect Outlook Connector Offline Edition, 'KOFF', before 10.0.9 Patch 2 contains a local privilege escalation vulnerability caused by weak installer permissions that leave the product directory writable by the built-in Users group. A local non-administrative attacker can...

CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353 GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment

GFI KerioConnect Kerio Connect before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of...

CVE-2026-112353

GFI KerioConnect (Kerio Connect) versions before 10.0.8 Patch 2 are susceptible to a stored cross-site scripting (XSS) vulnerability within the Webmail component. An attacker can upload a crafted SVG email attachment that bypasses sanitization of event-handler attributes. By exploiting an insuffi...

GFI KerioConnect cross-site scripting vulnerability

Versions prior to GFI KerioConnect 10.0.8 Patch 2 contain a cross-site scripting vulnerability. This flaw stems from improper sanitization of event handling attributes in uploaded SVG email attachments within the Webmail component. Attackers can execute JavaScript within a victim’s authenticated...

CVE-2026-112333

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

CVE-2026-112333 GFI Archiver < 15.14 Stored XSS via MailInsights.aspx

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

EUVD-2026-109064

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

CVE-2026-112333

GFI Archiver versions prior to 15.14 are vulnerable to a stored cross-site scripting (XSS) flaw within the MailInsights scheduled report configuration. The root cause is a lack of output encoding when the ReportScheduling.btnSaveReport_Click() function processes the report name parameter for the ...

PT-2026-122120

GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored...

GFI Software GFI Archiver cross-site scripting vulnerability

GFI Software GFI Archiver versions prior to 15.14 contain a cross-site scripting vulnerability. This vulnerability arises because the report name parameter for /Archiver/MailInsights.aspx is not output encoded in the MailInsights plan report configuration, resulting in stored cross-site scripting...