GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• gfi.ai/resource/kerioconnect-product-releases Yama
• vulncheck.com/…i-kerioconnect-9p2-xss-via-link-auto-formatter Üçüncü taraf

Kayıt geçmişi

1. 28 Eki 2026 18:26Yayımlandı

İlgili açıklar

• 7,8 CVE-2026-112357GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation
• 8,2 CVE-2026-112353GFI KerioConnect Webmail bileşeninde SVG eki üzerinden kalıcı siteler arası betik çalıştırma (XSS)
• 8,5 CVE-2026-116797Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
• 7,2 CVE-2026-116796Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
• 7,1 CVE-2026-115612WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
• 7,1 CVE-2026-115593WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability