EUVD-2026-30784
GHSA-pjr6-wxmx-75cg
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-accessible PHP endpoint with no auth required; victim click mandatory (UI:R); scope changes as script executes in browser context; no availability impact applies.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding, allowing a remote attacker to execute arbitrary JavaScript code in the context of a victim's browser.
AnalysisAI
Reflected XSS in HSC MailInspector v5.3.3-7 enables a remote unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted link targeting the /tap/tap.php PHP endpoint. The endpoint fails to sanitize user-controlled input before reflecting it in HTTP responses and does not adequately handle alternate or obfuscated JavaScript syntax designed to bypass basic filters - a detail suggesting the author tested filter evasion techniques. A public technical disclosure exists on GitHub (sql3t0/cve-disclosures), though SSVC assesses exploitation as none and EPSS sits at 0.04%, indicating no confirmed in-the-wild activity at time of analysis.
Technical ContextAI
HSC MailInspector is a PHP-based email security inspection and filtering product. The vulnerable component is /tap/tap.php, a server-side PHP script that processes user-supplied input and directly reflects it in HTTP responses without applying output encoding (CWE-79: Improper Neutralization of Input During Web Page Generation). The vulnerability is compounded by the failure to neutralize obfuscated or alternate JavaScript syntax - such as HTML event handlers, JavaScript URI schemes, or character-encoding tricks - which suggests that some filtering exists but can be bypassed. The CVSS Scope:Changed (S:C) metric confirms that the injected script executes in the victim's browser security context, crossing the trust boundary between the web application and the user's browser session. The affected CPE entry is non-specific (cpe:2.3:a:n/a:n/a:*), meaning NVD has not yet assigned a formal CPE string, limiting automated vulnerability management correlation.
RemediationAI
No vendor-released patch version has been confirmed from the available references. Administrators should monitor the HSC Labs product page at https://hsclabs.com/pt-br/mailinspector/ for a patched release and review the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-29964 for updated patch information. As an interim measure, if the MailInspector web interface does not require external internet access, restricting /tap/tap.php to internal IP ranges or trusted networks via firewall or reverse proxy ACLs is the most effective compensating control - note this may break legitimate external access to that endpoint. Deploying a Web Application Firewall rule to detect and block obfuscated JavaScript payloads in parameters reflected by /tap/tap.php can reduce exploitation success, though bypasses exist for most WAF signatures and this should not be treated as a permanent fix. The public disclosure at https://github.com/sql3t0/cve-disclosures/blob/main/03_-_CVE-2026-29964_XSS.md should be reviewed to understand payload patterns in scope.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today