CVE-2020-35741

HGiga MailSherlock does not validate user parameters on multiple login pages. Attackers can use the vulnerability to inject JavaScript syntax for XSS attacks.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
twcertCNA
7 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 52%
VendorProductVersion
hgigamsr45_isherlock-antispam
𝑥
< 4.5-133
hgigamsr45_isherlock-user
𝑥
< 4.5-120
hgigassr45_isherlock-antispam
𝑥
< 4.5-133
hgigassr45_isherlock-user
𝑥
< 4.5-120
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html
https://www.twcert.org.tw/tw/cp-132-4260-ba376-1.html