EIP-2026-102539
PRE-CVETotemomail 4.x/5.x - Persistent Cross-Site Scripting
Title source: legacyExploitation Summary
EIP tracks 1 public exploit for EIP-2026-102539. PoCs published by Vulnerability-Lab.
AI-analyzed exploit summary This document describes a persistent XSS vulnerability and filter bypass in Totemomail v4.x and v5.x, where malicious script codes can be injected into the 'Subject' and 'Message Body' fields, executed when the message is saved as HTML. The PoC demonstrates bypassing input validation using img tags with onload events.
Description
Totemomail 4.x/5.x - Persistent Cross-Site Scripting
Exploits (1)
This document describes a persistent XSS vulnerability and filter bypass in Totemomail v4.x and v5.x, where malicious script codes can be injected into the 'Subject' and 'Message Body' fields, executed when the message is saved as HTML. The PoC demonstrates bypassing input validation using img tags with onload events.