Gfi Archiver
Approved changes feed: RSS · Atom
cpe:2.3:a:gfi_software:gfi_archiver:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Gfi Software (fd9f5e15-62ca-5c4b-93cc-0ac4736c427c) |
|---|---|
| Product | Gfi Archiver (c9c43b01-d245-5f81-81e2-90c53191839b) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-48539 |
vulnerable | 2026-07-29 00:55:01.396584 |
GFI Archiver < 15.13 Stored XSS via MailInsights.aspx
MEDIUM (5.4)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
Published: 2026-07-23T15:32:59.409Z
Updated: 2026-07-28T01:49:30.714Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48538 |
vulnerable | 2026-07-29 00:55:01.396458 |
GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx
MEDIUM (5.4)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings.
Published: 2026-07-23T15:32:04.790Z
Updated: 2026-07-28T01:49:30.050Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48537 |
vulnerable | 2026-07-29 00:55:01.396282 |
GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx
MEDIUM (5.4)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
Published: 2026-07-23T15:31:11.236Z
Updated: 2026-07-28T01:49:29.387Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48536 |
vulnerable | 2026-07-29 00:55:01.396134 |
GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx
MEDIUM (5.4)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
Published: 2026-07-23T15:30:24.962Z
Updated: 2026-07-28T01:49:28.668Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48535 |
vulnerable | 2026-07-29 00:55:01.395903 |
GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx
MEDIUM (5.4)
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
Published: 2026-07-23T15:29:17.535Z
Updated: 2026-07-28T01:49:27.999Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48534 |
vulnerable | 2026-07-29 00:55:01.395758 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48532 |
vulnerable | 2026-07-29 00:55:01.395251 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48531 |
vulnerable | 2026-07-29 00:55:01.395087 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48530 |
vulnerable | 2026-07-29 00:55:01.394851 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.