EUVD-2026-62237
GHSA-qv73-xfjm-gc7w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible XSS requires victim interaction (UI:R); browser scope change (S:C) yields low C/I impact; no server-side availability or confidentiality impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
3DescriptionCVE.org
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.
AnalysisAI
Cross-site scripting in acmailer CGI and acmailer DB (Extra Innovation Inc.) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers when users interact with attacker-crafted content. Both distribution variants - the CGI-based and the database-backed editions - are confirmed affected per CPE data and JPCERT coordination (JVN#47716829). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Active user interaction is required - a victim must load or interact with attacker-controlled content (UI:A), such as clicking a crafted link or viewing a page containing a stored payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (Medium) accurately reflects the bounded impact of this XSS: server-side confidentiality, integrity, and availability are entirely unaffected (VC:N/VI:N/VA:N), while only the victim's browser context suffers low-level confidentiality and integrity harm (SC:L/SI:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch documented in the acmailer advisory at https://www.acmailer.jp/info/de.cgi?id=119; the specific fixed version must be confirmed from that advisory, as no precise version number is available in current intelligence. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Acmailer Db
View allImproper access control vulnerability in acmailer ver. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Privilege chaining vulnerability in acmailer ver. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today