MEDIUMCVSS v4 5.1Vulnerability
CVE-2026-120332
The HTML content of mails and tracked URLs are rendered unescaped in the backend module. Backend users with access to the mail module can inject arbitrary HTML and JavaScript, which is executed in the context of other backend users viewing the mail preview or report.
Properties
- Severity
- MEDIUM
- Nvd fetched at
- 2026-11-03T13:13:35.796279+00:00
- Cvss score
- 5.1
- Cvss severity
- MEDIUM
- Retrieved at
- 2026-11-03T13:14:57+00:00
- Score
- 5.1
- Last source
- NVD
- Cvss version
- 4.0
- Cve id
- CVE-2026-120332
- Cvss vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- First seen by Signal
- 2026-11-03T13:14:57+00:00
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Published at
- 2026-11-03T10:17:18.123
- Last modified
- 2026-11-03T10:17:18.123
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph