CVE-2022-29360

PoC —

CVSS 3.1

5.4 medium

EPSS

1%p66

Published

Jul 28, 2022 (Jul 28, 2022)

Modified

Jun 17, 2026

Description

The Email Viewer in RainLoop through 1.6.0 allows XSS via a crafted email message.

Vendors: rainloop
Products: webmail
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (1.2%)

In the news2 stories

Unpatched Bug in RainLoop Webmail Could Give Hackers Access to all Emails

The Hacker NewsApr 21, 10:50 UTC · Apr 21, 2022Vulnerability CVE-2022-29360

47

A stored XSS flaw in RainLoop allows stealing users' emails

Security AffairsApr 22, 14:07 UTC · Apr 22, 2022Vulnerability CVE-2022-29360

35