Volerion logoVolerion
Volerion logoVolerion

GFI MailEssentials AI Stored Cross-Site Scripting Vulnerability in Anti-Spoofing Configuration Page

Vulnerability

A stored cross-site scripting vulnerability has been identified in GFI MailEssentials AI versions prior to 22.4. The issue resides in the Anti-Spoofing configuration page, where an authenticated user can inject HTML or JavaScript into a specific parameter. This injected script is then stored and later executed in the management interface, impacting the logged-in user.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Remediation

Users can upgrade to GFI MailEssentials AI version 22.4 or later to address this vulnerability.

Added: Feb 19, 2026, 7:21 PM
Updated: Feb 19, 2026, 9:02 PM

Vulnerability Rating

Custom Algorithm
spread
4.5
impact
5.4
exploitability
3.2
remediation
7.7
relevance
3.2
threat
0.0
urgency
2.9
incentive
0.0

Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.