https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 14 Nov 2026 03:24:34 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-104083 <p>SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a &lt;style&gt; element nested within MathML foreign content (&lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an &lt;img src=x onerror=...&gt; payload that executes automatically in the recipient&#39;s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface&#39;s permissive Content-Security-Policy.</p> <p>SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a &lt;style&gt; element nested within MathML foreign content (&lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an &lt;img src=x onerror=...&gt; payload that executes automatically in the recipient&#39;s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface&#39;s permissive Content-Security-Policy.</p> https://db.gcve.eu/vuln/fkie_cve-2026-104083 https://db.gcve.eu/vuln/gcve-1988-2026-0493 <p><strong>Affected:</strong> unknown SmarterMail &lt;9777 Pre-Auth</p> <p>original blog: https://blog.evan.lat/posts/sm/</p> <p>SUMMARY: multiple vulns and misconfigurations in smartermail, notably a mxss and session persistence issues, alongside several logic bugs can be chained to achieve remote code execution as nt authority\system; https://nvd.nist.gov/vuln/detail/CVE-2026-104082 https://nvd.nist.gov/vuln/detail/CVE-2026-104083 https://nvd.nist.gov/vuln/detail/CVE-2026-104084</p> <p>a mutated xss exists in smartermail. by sending a specific text/calendar (icalendar) mimetype with the x-alt-desc header set to a mutated xss payload: &lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;&lt;style&gt;&lt;img src=x onerror=&#34;{js}&#34;&gt;&lt;/style&gt;</p> <p>the parser in the handrolled sanitizer of smartermail fails to properly sanitize this. the payload reforms after attempts at parsing it, allowing us to circumvent pre-auth with just one viewing of an email. notably, this can be done entirely without clicking as well (technically), since smartermail seems to open to latest email automatically</p> <p>====================</p> <p>a session logic vuln exists in smartermail. getting the refresh token of a domain admin before they are subsequently demoted does not actually invalidate any of the tokens privileges; meaning you can replay the token and continue retaining domain admin/sysadmin even after being demoted by simply posting the refresh token to /api/v1/auth/refresh-token and getting new accesstoken/refreshtoken pairs with the same roles</p> <p>====================</p> <p>a series of logic vulns exist in smartermail that can lead to rce a…</p> <p><strong>Affected:</strong> unknown SmarterMail &lt;9777 Pre-Auth</p> <p>original blog: https://blog.evan.lat/posts/sm/</p> <p>SUMMARY: multiple vulns and misconfigurations in smartermail, notably a mxss and session persistence issues, alongside several logic bugs can be chained to achieve remote code execution as nt authority\system; https://nvd.nist.gov/vuln/detail/CVE-2026-104082 https://nvd.nist.gov/vuln/detail/CVE-2026-104083 https://nvd.nist.gov/vuln/detail/CVE-2026-104084</p> <p>a mutated xss exists in smartermail. by sending a specific text/calendar (icalendar) mimetype with the x-alt-desc header set to a mutated xss payload: &lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;&lt;style&gt;&lt;img src=x onerror=&#34;{js}&#34;&gt;&lt;/style&gt;</p> <p>the parser in the handrolled sanitizer of smartermail fails to properly sanitize this. the payload reforms after attempts at parsing it, allowing us to circumvent pre-auth with just one viewing of an email. notably, this can be done entirely without clicking as well (technically), since smartermail seems to open to latest email automatically</p> <p>====================</p> <p>a session logic vuln exists in smartermail. getting the refresh token of a domain admin before they are subsequently demoted does not actually invalidate any of the tokens privileges; meaning you can replay the token and continue retaining domain admin/sysadmin even after being demoted by simply posting the refresh token to /api/v1/auth/refresh-token and getting new accesstoken/refreshtoken pairs with the same roles</p> <p>====================</p> <p>a series of logic vulns exist in smartermail that can lead to rce a…</p> https://db.gcve.eu/vuln/gcve-1988-2026-0493 https://db.gcve.eu/vuln/ghsa-vvh8-jc22-6q2f <p>SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a &lt;style&gt; element nested within MathML foreign content (&lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an &lt;img src=x onerror=...&gt; payload that executes automatically in the recipient&#39;s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface&#39;s permissive Content-Security-Policy.</p> <p>SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a &lt;style&gt; element nested within MathML foreign content (&lt;math&gt;&lt;mtext&gt;&lt;mglyph&gt;), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an &lt;img src=x onerror=...&gt; payload that executes automatically in the recipient&#39;s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface&#39;s permissive Content-Security-Policy.</p> https://db.gcve.eu/vuln/ghsa-vvh8-jc22-6q2f