Listen to this Post
How the CVE Works
The vulnerability exists in the `/admin/email/send-test-email` endpoint, where the `content` parameter fails to sanitize HTML input. Attackers with admin access can inject malicious HTML tags, such as <img src=x onerror=stealCookies()>, into email content. While JavaScript execution is blocked, HTML elements like fake login forms or phishing links can still be embedded. When the email is sent, recipients see the injected content, potentially leading to credential theft or further attacks. Server-side filtering only checks for `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.