CVE-2026-23608

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description GFI MailEssentials AI versions before 22.4 have a stored cross-site scripting issue. An authenticated user can inject HTML or JavaScript code into the JSON name field within the /MailEssentials/pages/MailSecurity/MailMonitoring.aspx/Save API endpoint. This injected code is then stored and displayed in the management interface, leading to script execution within the context of a logged-in user.

Recommendations Update GFI MailEssentials AI to version 22.4 or later.