This vulnerability in Zoho ZeptoMail (<= 3.3.1) involves Cross-Site Request Forgery (CSRF) that enables Stored XSS attacks. An attacker can trick an authenticated user into submitting a crafted request that results in malicious script storage within the application, potentially impacting confidentiality, integrity, and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and scope changed due to impact beyond the vulnerable component.

Successful exploitation can lead to unauthorized actions performed on behalf of the user and persistent cross-site scripting, which may allow attackers to steal sensitive information, manipulate data, or disrupt service availability. The CVSS score of 7.1 reflects a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Zoho's advisories for updates. Until a fix is available, consider applying any recommended temporary mitigations from the vendor or restricting access to affected versions where feasible.