Stored Cross-Site Scripting Vulnerability in HGiga's C&Cm@il Product
CVE-2025-2150

5.4MEDIUM

Key Information:

Vendor

Hgiga

Status
C&cm@il
Vendor
CVE Published:
10 March 2025

What is CVE-2025-2150?

The C&Cm@il product by HGiga contains a vulnerability that allows remote attackers to exploit Stored Cross-Site Scripting (XSS). This issue permits unauthorized individuals with minimal privileges to send emails embedded with harmful JavaScript code. When a user opens the email, the malicious script executes in their browser, potentially compromising user data and system security. This vulnerability underscores the need for rigorous email filtering and user awareness to prevent such attacks.

Affected Version(s)

C&Cm@il 0 < 1.0-238

References

https://www.twcert.org.tw/tw/cp-132-10004-99474-1.html
third-party-advisory
https://www.twcert.org.tw/en/cp-139-10005-05e0f-2.html
third-party-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.