HSC MailInspector Cross-Site Scripting Vulnerability

A Cross-Site Scripting (XSS) vulnerability has been identified in HSC MailInspector version 5.3.3-7. The issue resides in the '/mailinspector/tap/tap.php' endpoint, where user input is not properly sanitized before being reflected in HTTP responses. This flaw allows remote attackers to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, content manipulation, or phishing attacks.

Impact

Exploitation of this vulnerability allows for the execution of arbitrary JavaScript in the victim's browser, which could be used to steal session tokens, hijack user sessions, manipulate application content, or facilitate phishing or privilege escalation attacks.