CVE-2022-27105

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-26 · updated 2026-06-17
Weakness: CWE-79

Description

InMailX Outlook Plugin < 3.22.0101 is vulnerable to Cross Site Scripting (XSS). InMailX Connection names are not sanitzed in the Outlook tab, which allows a local user or network administrator to execute HTML / Javascript in the Outlook of users.

Affected products

Digitus Inmailx: from 3.21.0601 before 3.22.0101 — fixed in 3.22.0101

How to fix

Upgrade to a fixed version: Digitus Inmailx 3.22.0101. Check the vendor advisory for mitigations.

References

http://www.inmailx.com/products/inmailx
https://gist.github.com/0xVavaldi/9b7afbfe56938294480f7613805d3b7f
http://www.inmailx.com/products/inmailx
https://gist.github.com/TheWorkingDeveloper/9b7afbfe56938294480f7613805d3b7f

Get alerted when CVE-2022-27105 or the next vulnerability affects your stack