CVE-2026-129169

PMail versions 2.5.0 through 2.9.8 are vulnerable to a stored cross-site scripting (XSS) vulnerability via the /api/email/send endpoint. The root cause is the processing of unsanitized HTML in the email body, which allows authenticated users to inject malicious scripts. These scripts can execute ...