GFI MailEssentials AI up to 22.3 Management Interface ipdnsblocklist.aspx ctl00$ContentPlaceHolder1$pv1$TXB_IPs cross site scripting

Summaryinfo

A vulnerability categorized as problematic has been discovered in GFI MailEssentials AI up to 22.3. Affected by this vulnerability is an unknown functionality of the file /MailEssentials/pages/MailSecurity/ipdnsblocklist.aspx of the component Management Interface. Executing a manipulation of the argument ctl00$ContentPlaceHolder1$pv1$TXB_IPs can lead to cross site scripting. The identification of this vulnerability is CVE-2026-23612. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in GFI MailEssentials AI up to 22.3. It has been declared as problematic. This vulnerability affects an unknown functionality of the file /MailEssentials/pages/MailSecurity/ipdnsblocklist.aspx of the component Management Interface. The manipulation of the argument ctl00$ContentPlaceHolder1$pv1$TXB_IPs with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the IP DNS Blocklist configuration page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$pv1$TXB_IPs parameter to /MailEssentials/pages/MailSecurity/ipdnsblocklist.aspx, which is stored and later rendered in the management interface, allowing script execution in the context of a logged-in user.

The weakness was shared by Alex Williams. The advisory is shared for download at gfi.ai. This vulnerability was named CVE-2026-23612 since 01/14/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

By approaching the search of inurl:MailEssentials/pages/MailSecurity/ipdnsblocklist.aspx it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 22.4 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• GFI

Name

• MailEssentials AI

Version

• 22.0
• 22.1
• 22.2
• 22.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion