Description
A Cross-Site Script Inclusion vulnerability was found on LiquidFiles before 3.3.19. This client-side attack requires user interaction (opening a link) and successful exploitation could lead to encrypted e-mail content leakage via messages/sent?format=js and popup?format=js.
Scores
CVSS v3
6.1
EPSS
0.0024
EPSS Percentile
47.5%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Details
CWE
CWE-829
Status
published
Products (1)
liquidfiles/liquidfiles
< 3.3.19
Published
Nov 25, 2020
Tracked Since
Feb 18, 2026