CVE-2020-35740: HGiga MailSherlock - XSS -1

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-31 · updated 2026-06-17
Weakness: CWE-79

Description

HGiga MailSherlock does not validate specific URL parameters properly that allows attackers to inject JavaScript syntax for XSS attacks.

Affected products

HGiga Msr45 Isherlock-Antispam: before 4.5-133 — fixed in 4.5-133
HGiga Msr45 Isherlock-User: before 4.5-120 — fixed in 4.5-120
HGiga Ssr45 Isherlock-Antispam: before 4.5-133 — fixed in 4.5-133
HGiga Ssr45 Isherlock-User: before 4.5-120 — fixed in 4.5-120

How to fix

Upgrade to a fixed version: HGiga Msr45 Isherlock-Antispam 4.5-133; HGiga Msr45 Isherlock-User 4.5-120; HGiga Ssr45 Isherlock-Antispam 4.5-133; HGiga Ssr45 Isherlock-User 4.5-120. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-35740 or the next vulnerability affects your stack