CVE-2020-35740: HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.

PriorityP423medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.61%

44.8th percentile

HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
hgiga	mailsherlock_msr45_ssr45	>= unspecified < 120	120
hgiga	mailsherlock_msr45_ssr45	>= unspecified < 133	133
hgiga	msr45_isherlock-antispam	< 4.5-133	4.5-133
hgiga	msr45_isherlock-user	< 4.5-120	4.5-120
hgiga	ssr45_isherlock-antispam	< 4.5-133	4.5-133
hgiga	ssr45_isherlock-user	< 4.5-120	4.5-120

CVSS provenance

nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.