CVE-2026-23618

Name of the Vulnerable Software and Affected Versions GFI MailEssentials AI versions prior to 22.4

Description GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting issue. An authenticated user can inject HTML or JavaScript code into the ctl00$ContentPlaceHolder1$pvSubject$TXB SubjectCondition parameter of the /MailEssentials/pages/MailSecurity/ASKeywordChecking.aspx API endpoint. This injected code is then stored and executed within the management interface when rendered, potentially allowing script execution in the context of a logged-in user.

Recommendations Update GFI MailEssentials AI to version 22.4 or later.