CVE-2021-47768

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-47768
ImportExportTools NG 10.0.4 contains a persistent HTML injection vulnerability in the email export module that allows remote attackers to inject malicious HTML payloads. Attackers can send emails with crafted HTML in the subject that execute during HTML export, potentially compromising user data or session credentials.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/ Product
https://github.com/thundernest/import-export-tools-ng Product
https://www.exploit-db.com/exploits/50496 Exploit
https://www.vulnerability-lab.com/get_content.php?id=2308 Third Party Advisory
https://www.exploit-db.com/exploits/50496 Exploit
https://www.vulnerability-lab.com/get_content.php?id=2308 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:cleidigh:importexporttools_ng:10.0.4:*:*:*:*:thunderbird:*:*
History

17 Jun 2026, 04:18

Type Values Removed Values Added
Summary
  • (es) ImportExportTools NG 10.0.4 contiene una vulnerabilidad de inyección HTML persistente en el módulo de exportación de correo electrónico que permite a atacantes remotos inyectar cargas útiles HTML maliciosas. Los atacantes pueden enviar correos electrónicos con HTML manipulado en el asunto que se ejecuta durante la exportación HTML, comprometiendo potencialmente datos de usuario o credenciales de sesión.

30 Jan 2026, 20:00

Type Values Removed Values Added
CPE cpe:2.3:a:cleidigh:importexporttools_ng:10.0.4:*:*:*:*:thunderbird:*:*
References () https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/ - () https://addons.thunderbird.net/en-US/thunderbird/addon/importexporttools-ng/ - Product
References () https://github.com/thundernest/import-export-tools-ng - () https://github.com/thundernest/import-export-tools-ng - Product
References () https://www.exploit-db.com/exploits/50496 - () https://www.exploit-db.com/exploits/50496 - Exploit
References () https://www.vulnerability-lab.com/get_content.php?id=2308 - () https://www.vulnerability-lab.com/get_content.php?id=2308 - Third Party Advisory
First Time Cleidigh importexporttools Ng
Cleidigh

15 Jan 2026, 19:16

Type Values Removed Values Added
References () https://www.exploit-db.com/exploits/50496 - () https://www.exploit-db.com/exploits/50496 -
References () https://www.vulnerability-lab.com/get_content.php?id=2308 - () https://www.vulnerability-lab.com/get_content.php?id=2308 -

15 Jan 2026, 16:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-15 16:16

Updated : 2026-06-17 04:18

NVD link : CVE-2021-47768

Mitre link : CVE-2021-47768

CVE.ORG link : CVE-2021-47768

JSON object : View

Products Affected

cleidigh

  • importexporttools_ng
CWE
CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')