Raw JSON
{
"containers": {
"cna": {
"affected": [
{
"product": "SmarterMail",
"vendor": "SmarterTools",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Egidio Romano"
}
],
"descriptions": [
{
"lang": "en",
"value": "----------------------------------------------------------------------------\nSmarterMail <= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability\n----------------------------------------------------------------------------\n\n\n[-] Software Link:\n\nhttps://www.smartertools.com/smartermail/business-email-server\n\n\n[-] Affected Versions:\n\nBuild 9518 and prior builds.\n\n\n[-] Vulnerability Description:\n\nUser input passed through the \"MailboxId\" GET parameter to the MAPI\nendpoints is not properly sanitized before being used to generate HTML\noutput. This can be exploited by attackers to perform Reflected Cross-Site\nScripting (XSS) attacks which, in turn, might lead to 1-click Remote\nCommand Execution (RCE) attacks.\n\n\n[-] Proof of Concept:\n\nhttps://karmainsecurity.com/pocs/CVE-2026-26930.html\n\n\n[-] Solution:\n\nUpgrade to build 9526 or later.\n\n\n[-] Disclosure Timeline:\n\n[26/01/2026] - Vendor notified\n\n[26/01/2026] - Vendor response stating \"we will get this over to the\ndevelopers for evaluation\"\n\n[30/01/2026] - Vendor released build 9526\n\n[03/02/2026] - CVE identifier requested\n\n[16/02/2026] - CVE identifier assigned\n\n[16/02/2026] - Public disclosure\n\n\n[-] CVE Reference:\n\nThe Common Vulnerabilities and Exposures project (cve.org) has assigned the\nname CVE-2026-26930 to this vulnerability.\n\n\n[-] Credits:\n\nVulnerability discovered by Egidio Romano.\n\n\n[-] Original Advisory:\n\nhttps://karmainsecurity.com/KIS-2026-04\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives & RSS: https://seclists.org/fulldisclosure/"
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:39:49Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Feb/30"
},
{
"url": "https://karmainsecurity.com/KIS-2026-04"
},
{
"url": "https://karmainsecurity.com/pocs/CVE-2026-26930.html"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://www.smartertools.com/smartermail/business-email-server"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Feb/30"
],
"discovery": "EXTERNAL"
},
"title": "[KIS-2026-04] SmarterMail <= 9518 (MailboxId) Reflected Cross-Site Scripting Vulnerability",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-26930",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0188",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Feb/30",
"automated": true,
"contentSha256": "1b9c0c62d6540010d20336b53c97c6e3695dd861abc3b0020cb27c5449f7e8f9",
"evidenceScore": 7,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Feb/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-02-16T22:32:17Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:57:41Z",
"dateUpdated": "2026-09-09T13:39:49Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0188"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}