CVE-2012-2587 Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribut...

MediumCVSS 4.3 EPSS 1.3% Public exploit

Published: 2012-08-13 00:00
Updated: 2026-06-17 02:41
Exploit status: Public exploit available

Description

Multiple cross-site scripting (XSS) vulnerabilities in AfterLogic MailSuite Pro 6.3 allow remote attackers to inject arbitrary web script or HTML via an e-mail message body with a crafted SRC attribute of (1) an IFRAME element or (2) a SCRIPT element.

Affected products

Product	Affected versions	Fixed in
afterlogic mailsuite pro	= 6.3	No fix listed

References

20352 exploit

CVSS v2.0

4.3 Medium

AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality: None
Integrity: Partial
Availability: None

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.32% (percentile 71.2)
CWE: CWE-79

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

afterlogic mailsuite pro (VMware Appliance) 6.3 - Persistent Cross-Site Scripting Exploit · Exploit Database (OffSec) · 2012-08-08