← Database

CVE-2026-125389

MEDIUM CVSS: 6.1 Published: 2026-11-10 Modified: 2026-11-10

Description

Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in the email viewer due to a flawed regex in StringHelper::filterXSS. Remote attackers can send emails containing tags like svg/onload, which MessagePanel.js renders raw, executing script in the recipient's session when opened.

Affected Platforms

Unknown

Weakness Type

CWE-79

References