PT-2026-47717

CVE-2026-34033

Published

2026-06-09

Updated

2026-09-04

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.1

Description An issue exists where user-supplied content is included in notification emails without proper escaping. This allows authenticated users to perform Cross-Site Scripting (XSS), which is the injection of malicious scripts into benign websites, by injecting arbitrary HTML into emails sent to other users.

Recommendations Upgrade to version 2.0.1.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Related identifiers