Threats tagged 'ghsa-vx3x-mxfj-w8gc'

PMail versions 2.5.0 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts via unsanitized HTML in the /api/email/send endpoint. These scripts can execute when administrators view the message, potentially allowing attackers to perform privileged API actions such as changing passwords and taking over accounts.