HSC MailInspector v5.3.3-7 contains a Cross-Site Scripting (XSS) vulnerability in the /tap/tap.php endpoint due to improper neutralization of user-controlled input using alternate or obfuscated JavaScript syntax. The endpoint reflects unsanitized user input in HTTP responses without adequate output encoding, allowing a remote attacker to execute arbitrary JavaScript code in the context of a victim's browser.
References
| Link | Resource |
|---|---|
| https://github.com/sql3t0/cve-disclosures | Third Party Advisory |
| https://github.com/sql3t0/cve-disclosures/blob/main/03_-_CVE-2026-29964_XSS.md | Third Party Advisory |
| https://hsclabs.com/pt-br/mailinspector/ | Product |
Configurations
History
19 May 2026, 17:20
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Hsclabs mailinspector
Hsclabs |
|
| CPE | cpe:2.3:a:hsclabs:mailinspector:5.3.3-7:*:*:*:*:*:*:* | |
| References | () https://github.com/sql3t0/cve-disclosures - Third Party Advisory | |
| References | () https://github.com/sql3t0/cve-disclosures/blob/main/03_-_CVE-2026-29964_XSS.md - Third Party Advisory | |
| References | () https://hsclabs.com/pt-br/mailinspector/ - Product |
18 May 2026, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.1 |
| CWE | CWE-79 |
18 May 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-18 18:17
Updated : 2026-05-19 17:20
NVD link : CVE-2026-29964
Mitre link : CVE-2026-29964
CVE.ORG link : CVE-2026-29964
JSON object : View
Products Affected
hsclabs
- mailinspector
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')