CVE-2026-29964 describes a Cross-Site Scripting vulnerability in HSC MailInspector v5.3.3-7. The issue exists in the /tap/tap.php endpoint, where user-controlled input is reflected in HTTP responses without adequate output encoding or sanitization. Attackers can exploit this by injecting alternate or obfuscated JavaScript syntax, leading to arbitrary script execution in the context of a victim's browser. The vulnerability is publicly disclosed but lacks a CVSS score and official remediation details. No known exploits have been reported.

Successful exploitation allows remote attackers to execute arbitrary JavaScript code within the victim's browser session when accessing the vulnerable endpoint. This can lead to session hijacking, information disclosure, or other client-side impacts typical of XSS vulnerabilities. There is no information about further system compromise or elevated privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider applying input validation and output encoding controls at the application level if possible. Monitor vendor communications for updates on patches or mitigations.