EUVD-2026-30782
GHSA-qrv4-g78c-hphg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no auth required but mandatory user click; scope changes to browser context enabling session theft.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax.
AnalysisAI
Reflected cross-site scripting in HSC MailInspector 5.3.3-7 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the /police/WarningUrlPage.php endpoint. The vulnerability is notable because it bypasses input filters using alternate or obfuscated JavaScript syntax, and the CVSS Scope:Changed rating indicates execution occurs in the browser's security context rather than the server's. A public researcher disclosure exists on GitHub (sql3t0/cve-disclosures), though no active exploitation has been confirmed by CISA KEV, and EPSS at 0.03% (8th percentile) reflects minimal current exploitation activity.
Technical ContextAI
HSC MailInspector is a PHP-based email security and inspection platform developed by HSC Labs (hsclabs.com/pt-br). The vulnerable endpoint /police/WarningUrlPage.php fails to properly neutralize user-supplied input before reflecting it into the HTML response, constituting CWE-79 (Improper Neutralization of Input During Web Generation). Critically, the description specifies that alternate or obfuscated JavaScript syntax is used to trigger the vulnerability, indicating that some level of input sanitization or filtering exists but can be bypassed via encoding tricks, HTML entity obfuscation, or non-standard event handlers common in filter-bypass XSS techniques. The CVSS S:C (Scope Changed) rating confirms the injected script executes in the victim's browser context - a different security principal from the server - enabling access to session cookies, local storage, or DOM content that may include sensitive email metadata or authentication tokens.
RemediationAI
No vendor-released patch has been identified at time of analysis. No specific fix version appears in any referenced advisory. Organizations running HSC MailInspector 5.3.3-7 should contact HSC Labs directly via the vendor site at https://hsclabs.com/pt-br/mailinspector/ to request a patched release. As a compensating control, restrict access to the /police/WarningUrlPage.php endpoint via web application firewall rules or network-layer access controls to limit who can reach it - note this may impact legitimate warning page functionality for end users. Deploying a WAF rule targeting obfuscated JavaScript patterns (e.g., ModSecurity CRS rules for XSS) can reduce exploitation likelihood but carries a risk of false positives on legitimate email content. Implementing a Content Security Policy (CSP) header on the application, particularly a restrictive script-src directive, would significantly limit the impact of any successful XSS injection even if the underlying flaw is not patched. The full technical disclosure is available at https://github.com/sql3t0/cve-disclosures/blob/main/04_-_CVE-2026-29965_XSS.md and should be reviewed to understand the specific payload patterns involved.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today