CVE Feed

    Dashboard / CVE / CVE-2026-48536

    CVE-2026-48536

    GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.

    Published:Jul 23, 2026
    Last Modified:Jul 28, 2026
    EPS:Jul 23, 2026
    EPSS Score:0.00138
    CVSS Score:5.4

    Affected Products

    Vendor
    Gfi
    Product
    Archiver
    Vendor
    Gfi Software
    Product
    Gfi Archiver

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-48539 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled r…
    CVE-2026-48538 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings …
    CVE-2026-48537 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant c…
    CVE-2026-48535 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server c…
    CVE-2026-48534 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuratio…
    CVE-2026-48532 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention P…
    CVE-2026-48531 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configu…
    CVE-2026-48530 (CVSS 5.1) — GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules con…
    CVE-2026-2039 (CVSS 9.8) — GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows r…
    CVE-2026-2036 (CVSS 8.8) — GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerabil…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High