CVE-2026-29965
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax.
Risk Assessment
An attacker can execute arbitrary JavaScript in the victim's browser, potentially leading to session theft, redirects, or actions performed on behalf of the user.
Recommendation
Update HSC MailInspector to a version containing the fix or implement input validation and sanitization in the WarningUrlPage.php endpoint. Consider deploying a Content-Security-Policy header.
Other vulnerabilities in HSC MailInspector
See all- CVE-2026-29964Medium
HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding.
- CVE-2026-29963High
HSC MailInspector version 5.3.3-7 has a Path Traversal vulnerability due to improper validation of user-supplied input in the /tap/dw.php endpoint. The text parameter is used to construct file paths without adequate normalization or restriction to a safe base directory.
- CVE-2026-29962High
HSC MailInspector v5.3.3-7 contains a Local File Inclusion (LFI) vulnerability caused by improper control of user-supplied file paths. The endpoint /vendor/phpunit/phpunit.php processes user-controlled parameters, allowing unauthorized access to system files.
Original NVD description (English source)
HSC MailInspector 5.3.3-7 is vulnerable to Cross Site Scripting (XSS) in the /police/WarningUrlPage.php endpoint due to improper neutralization of user-supplied input that uses alternate or obfuscated JavaScript syntax.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS