{"schema":"threatline.record/2","record":{"id":"CVE-2026-112333","aliases":[],"summary":"GFI Archiver < 15.14 Stored XSS via MailInsights.aspx","details":"GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.","categories":["Unclassified"],"product":"GFI Archiver","vendor":"GFI Software","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112333","source_modified_at":"2026-10-23T14:16:48.726Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"GFI Archiver","vendor":"GFI Software","versions":[{"status":"affected","version":"0","versionType":"custom","lessThan":"15.14"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-112333","source_modified_at":"2026-10-23T14:16:48.726Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"GFI Archiver","ecosystem":null},"version":"15.14","basis":"first unaffected version stated in the CVE record"}],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-23T14:16:48.726Z","modified_at":"2026-10-23T14:16:48.726Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-112333","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23T14:16:48.726Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://gfi.ai/products-and-solutions/network-security-solutions/archiver/resources/documentation/product-releases","tags":["patch","release-notes"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/gfi-archiver-stored-xss-via-mailinsights-aspx"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-23T14:16:48.726Z","content_hash":"7f3b86ecfc17b9bb84800e325fc726fc8c28752c4980223bb7b1a8053432a010"}}