CVE-2023-48115

PoC —

CVSS 3.1

5.4 medium

EPSS

<1%p29

Published

Dec 21, 2023 (Dec 21, 2023)

Modified

Jun 17, 2026

Description

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored DOM XSS because an XSS protection mechanism is skipped when messageHTML and messagePlainText are set in the same request.

Vendors: smartertools
Products: smartermail
Weakness: CWE-79
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

NVD CVE.org GitHub PoCs EPSS (0.4%)

In the news0 stories

No ingested article mentions this CVE yet.