EUVD-2026-48292
GHSA-c6r4-5qxc-q87c
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page.
AnalysisAI
Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to inject persistent JavaScript payloads via the policy name field of the File History Retention Policy wizard. The injected payload is written to storage by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and subsequently executes in the browser of any user — including higher-privileged administrators — who views the File History Retention Policies page. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 5.1 reflects the passive user-interaction dependency that limits immediate attacker control.
More in Gfi Archiver
View allStored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious s
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web scri
Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary Ja
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persist
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject per
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently i
Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbi
Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persist
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today