Stored Cross-Site Scripting in GFI MailEssentials AI

CVE-2026-23613

What is CVE-2026-23613?

GFI MailEssentials AI prior to version 22.4 contains a stored cross-site scripting vulnerability that can be exploited through the URI DNS Blocklist configuration page. This issue allows an authenticated user to inject malicious HTML or JavaScript into the ctl00$ContentPlaceHolder1$pv1$TXB_URIs parameter. The input is stored and later rendered in the management interface, enabling script execution in the context of any logged-in user. This could lead to unauthorized actions or data exposure within the application.

References