Threats tagged 'ghsa-qp22-4vrj-5v6w'

Intermesh Group-Office versions prior to 6.8.181, 25.0.116, and 26.0.58 contain a stored cross-site scripting (XSS) vulnerability in the email viewer. This flaw arises from a defective regular expression in the StringHelper::filterXSS function, allowing remote attackers to send emails with malicious tags such as svg/onload. When these emails are opened, the MessagePanel.js component renders the malicious content without proper sanitization, leading to script execution in the recipient's session.