CVE-2026-102372

EUVD-2026-88596
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Cross-site Scripting
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
6.1 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 10.21%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
gestsupgestsup
𝑥
< 3.2.62
CNA
Common Weakness Enumeration
References
https://gestsup.fr/index.php?page=changelog
https://gestsup.fr/index.php?page=download
https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patch
https://www.vulncheck.com/advisories/gestsup-before-3.2.62-stored-xss-via-email-body-in-login-imap-connector