https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 18:51:52 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-112353 <p>GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim&#39;s authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint&#39;s insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim&#39;s credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.</p> <p>GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim&#39;s authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint&#39;s insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim&#39;s credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.</p> https://db.gcve.eu/vuln/fkie_cve-2026-112353 https://db.gcve.eu/vuln/ghsa-x85g-q7vc-7jh7 <p>GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim&#39;s authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint&#39;s insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim&#39;s credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.</p> <p>GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim&#39;s authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint&#39;s insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim&#39;s credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.</p> https://db.gcve.eu/vuln/ghsa-x85g-q7vc-7jh7