CVE-2010-4646

Hastymail2 < 1.0 - XSS

Title source: rule

Description

Cross-site scripting (XSS) vulnerability in Hastymail2 before 1.01 allows remote attackers to inject arbitrary web script or HTML via a crafted background attribute within a cell in a TABLE element, related to improper use of the htmLawed filter.

References (5)

[Patch] http://openwall.com/lists/oss-security/2011/01/05/3

[Patch] http://openwall.com/lists/oss-security/2011/01/06/14

[Patch, Vendor Advisory] http://www.hastymail.org/security/

[Third Party Advisory, VDB Entry] https://exchange.xforce.ibmcloud.com/vulnerabilities/64962

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/43681

Scores

EPSS 0.0033

EPSS Percentile 55.5%

Classification

CWE

CWE-79

Status published

Affected Products (14)

hastymail/hastymail2

hastymail/hastymail2 < 1.0

n/a/n/a

Timeline

Published Jan 18, 2011

Tracked Since Feb 18, 2026