6.1
CVE-2021-47768
- EPSS 0.32%
- Veröffentlicht 15.01.2026 15:52:10
- Zuletzt bearbeitet 30.01.2026 20:00:04
- Quelle disclosure@vulncheck.com
- CVE-Watchlists
- Unerledigt
LoginImportExportTools NG 10.0.4 - HTML Injection
ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Cleidigh ≫ Importexporttools Ng Version10.0.4 SwPlatformthunderbird
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.32% | 0.235 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| disclosure@vulncheck.com | 5.3 | 0 | 0 |
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| disclosure@vulncheck.com | 6.1 | 2.8 | 2.7 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
https://www.exploit-db.com/exploits/50496
https://github.com/thundernest/import-export-tools-ng
https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/
https://www.vulnerability-lab.com/get_content.php?id=2308