Live › vulnerability › CVE-2026-112333
Go to dashboardGFI Archiver before 15.14 does not encode the report name of MailInsights scheduled reports, so HTML or script saved there is stored. The script runs in the browser of the user who later opens the MailInsights page, which can let an attacker act as that user in the Archiver web console.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running GFI Archiver before 15.14 where users can log in and create MailInsights scheduled reports. The attacker needs an authenticated account, and the victim must later view the MailInsights page. Installations on 15.14 or later, or without any MailInsights reports in use, can skip this.
No product ranges from the sources yet.
15.14 are in scope/Archiver/MailInsights.aspx15.14 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
This page as .md · .json · in your agent: get_signal("CVE-2026-112333")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.