Vulnerabilities

TI-2026-19022 CVE-2026-23621 · GHSA-pcxg-vcf2-rp56

GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration

LOW 24

GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsP…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00283 Published 2026-02-19 Fixed in 22.4 CWE-203

TI-2026-19021 CVE-2026-23620 · GHSA-vp99-6r6x-6v3c

GFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00213 Published 2026-02-19 Fixed in 22.4 CWE-203

TI-2026-19020 CVE-2026-23619 · GHSA-jh5v-5566-88p4

GFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains settings page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19019 CVE-2026-23618 · GHSA-4vq4-242h-q9qr

GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Subject) conditions interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19018 CVE-2026-23617 · GHSA-wmpp-2v6j-mq33

GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19017 CVE-2026-23616 · GHSA-54pq-hwv5-65gf

GFI MailEssentials AI < 22.4 Anti-Spam Anti-Spoofing Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19016 CVE-2026-23615 · GHSA-h2h9-5q4p-862f

GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework Email Exceptions Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework Email Exceptions interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00194 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19015 CVE-2026-23614 · GHSA-h337-mc5p-h2rq

GFI MailEssentials AI < 22.4 Anti-Spam Sender Policy Framework IP Exceptions Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Sender Policy Framework IP Exceptions interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19014 CVE-2026-23613 · GHSA-m425-8325-xcgg

GFI MailEssentials AI < 22.4 Anti-Spam URI DNS Blocklist Domain Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the URI DNS Blocklist configuration page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00194 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19013 CVE-2026-23612 · GHSA-855r-j6w5-8868

GFI MailEssentials AI < 22.4 Anti-Spam IP DNS Blocklist Domain Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19012 CVE-2026-23611 · GHSA-6f86-pp6p-mrph

GFI MailEssentials AI < 22.4 Anti-Spam IP Blocklist Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP Blocklist management page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19011 CVE-2026-23610 · GHSA-rrcr-4pq7-hrcc

GFI MailEssentials AI < 22.4 POP2Exchange POP3 Server Login Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the POP2Exchange configuration endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19010 CVE-2026-23609 · GHSA-jwf5-w959-739v

GFI MailEssentials AI < 22.4 General Settings Perimeter SMTP Servers Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Perimeter SMTP Servers configuration page.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19009 CVE-2026-23608 · GHSA-xjfr-756p-4phv

GFI MailEssentials AI < 22.4 Email Management Mail Monitoring Rule Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Mail Monitoring rule creation endpoint.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19008 CVE-2026-23607 · GHSA-6ccf-h672-3wqh

GFI MailEssentials AI < 22.4 Anti-Spam Whitelist Description Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spam Whitelist management interface.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19007 CVE-2026-23606 · GHSA-xwc9-vwhh-qfwc

GFI MailEssentials AI < 22.4 Advanced Content Filtering Rule Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Advanced Content Filtering rule creation workflow.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19006 CVE-2026-23605 · GHSA-qxv5-rwp8-8gff

GFI MailEssentials AI < 22.4 Attachment Filtering Rule Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Attachment Filtering rule creation workflow.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2026-19005 CVE-2026-23604 · GHSA-4c3j-77qx-q688

GFI MailEssentials AI < 22.4 Keyword Filtering Rule Stored XSS

LOW 23

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Keyword Filtering rule creation workflow.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00206 Published 2026-02-19 Fixed in 22.4 CWE-79

TI-2025-24524 CVE-2025-34491 · GHSA-fqqj-qgxm-vg3x

GFI MailEssentials < 21.8 MultiNode Insecure Deserialization

HIGH 73

GFI MailEssentials prior to version 21.8 is vulnerable to a .NET deserialization issue.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00963 Published 2025-04-28 Fixed in 21.8 CWE-502

TI-2025-24523 CVE-2025-34490 · GHSA-2vcm-447j-6j4j

GFI MailEssentials < 21.8 XXE Arbitrary File Read

LOW 30

GFI MailEssentials prior to version 21.8 is vulnerable to an XML External Entity (XXE) issue.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00729 Published 2025-04-28 Fixed in 21.8 CWE-611

TI-2025-24522 CVE-2025-34489 · GHSA-6h6j-8576-v4xg

GFI MailEssentials < 21.8 Local Privilege Escalation

HIGH 69

GFI MailEssentials prior to version 21.8 is vulnerable to a local privilege escalation issue.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00327 Published 2025-04-28 Fixed in 21.8 CWE-502

TI-2004-01190 CVE-2004-1312 · GHSA-jm4q-cpwg-j7g7

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third…

MEDIUM 48

A bug in the HTML parser in a certain Microsoft HTML library, as used in various third party products, may allow remote attackers to cause a denial of service via certain strings, as reported in GFI MailEssentials for Ex…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.0247 Published 2005-01-06 No fix listed

Vulnerabilities

Filters