Listen to this Post
The vulnerability is a reflected Cross-Site Scripting (XSS) flaw within MailEnable’s web interface. Specifically, the `Added` parameter in the `/Mondo/lang/sys/Forms/MAI/AddRecipientsResult.aspx` endpoint fails to sanitize user input when processed via a GET request. An attacker can craft a malicious URL where the `Added` parameter contains a payload designed to escape the existing HTML list element context. This payload, typically closing a `
` tag and injecting a `
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent may adversely affect certain features and functions.
We do not sell your personal data. If you wish to exercise your rights under applicable privacy laws, please visit our Do Not Sell My Personal Information page.