Mailessentials
Approved changes feed: RSS · Atom
cpe:2.3:a:gfi:mailessentials:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Gfi (cd394833-109c-5606-a2f3-854a54717243) |
|---|---|
| Product | Mailessentials (16a8e598-b1bc-5cec-ae02-a5090a8b5f60) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-23621 |
vulnerable | 2026-06-08 07:51:15.669441 |
GFI MailEssentials AI < 22.4 ListServer.IsPathExist() Absolute Directory Traversal to File Enumeration
MEDIUM (4.3)
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary directory existence enumeration vulnerability in the ListServer.IsPathExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsPathExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to Directory.Exists(), allowing the attacker to determine whether arbitrary directories exist on the server.
Published: 2026-02-19T18:01:03.571Z
Updated: 2026-05-14T02:09:21.337Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23620 |
vulnerable | 2026-06-08 07:51:15.669079 |
GFI MailEssentials AI < 22.4 ListServer.IsDBExist() Absolute Directory Traversal to File Enumeration
MEDIUM (4.3)
GFI MailEssentials AI versions prior to 22.4 contain an arbitrary file existence enumeration vulnerability in the ListServer.IsDBExist() web method exposed at /MailEssentials/pages/MailSecurity/ListServer.aspx/IsDBExist. An authenticated user can supply an unrestricted filesystem path via the JSON key \"path\", which is URL-decoded and passed to File.Exists(), allowing the attacker to determine whether arbitrary files exist on the server.
Published: 2026-02-19T18:00:35.460Z
Updated: 2026-05-26T11:52:03.484Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23619 |
vulnerable | 2026-06-08 07:51:15.668583 |
GFI MailEssentials AI < 22.4 General Settings Local Domains Domain Description Stored XSS
MEDIUM (5.4)
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Local Domains settings page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$Pv3$txtDescription parameter to /MailEssentials/pages/MailSecurity/general.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
Published: 2026-02-19T18:00:09.116Z
Updated: 2026-05-14T02:09:19.619Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23618 |
vulnerable | 2026-06-08 07:51:15.668079 |
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Subject Condition Stored XSS
MEDIUM (5.4)
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Subject) conditions interface. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pvSubject$TXB_SubjectCondition parameter to /MailEssentials/pages/MailSecurity/ASKeywordChecking.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
Published: 2026-02-19T17:59:37.489Z
Updated: 2026-05-14T02:09:18.924Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23617 |
vulnerable | 2026-06-08 07:51:15.667557 |
GFI MailEssentials AI < 22.4 Anti-Spam Spam Keyword Checking Body Condition Stored XSS
MEDIUM (5.4)
GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Spam Keyword Checking (Body) conditions interface. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pvGeneral$TXB_Condition parameter to /MailEssentials/pages/MailSecurity/ASKeywordChecking.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.
Published: 2026-02-19T17:59:16.563Z
Updated: 2026-05-14T02:09:18.196Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23616 |
vulnerable | 2026-06-08 07:51:15.667085 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23615 |
vulnerable | 2026-06-08 07:51:15.666726 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23614 |
vulnerable | 2026-06-08 07:51:15.666275 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23613 |
vulnerable | 2026-06-08 07:51:15.665727 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23612 |
vulnerable | 2026-06-08 07:51:15.665265 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23611 |
vulnerable | 2026-06-08 07:51:15.664791 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23610 |
vulnerable | 2026-06-08 07:51:15.664435 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23609 |
vulnerable | 2026-06-08 07:51:15.663969 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23608 |
vulnerable | 2026-06-08 07:51:15.663614 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23607 |
vulnerable | 2026-06-08 07:51:15.663236 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23606 |
vulnerable | 2026-06-08 07:51:15.662621 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23605 |
vulnerable | 2026-06-08 07:51:15.661972 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-23604 |
vulnerable | 2026-06-08 07:51:15.661417 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34491 |
vulnerable | 2026-06-08 07:20:59.632692 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34490 |
vulnerable | 2026-06-08 07:20:59.632127 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-34489 |
vulnerable | 2026-06-08 07:20:59.631541 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.