CVE-2025-2150: HGiga C&Cm@il - Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-03-10 · updated 2026-06-17
Weakness: CWE-79

Description

The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malicious JavaScript code, which will be executed in the recipient's browser when they view the email.

Affected products

HGiga C&Cm@Il: all versions

References

https://www.twcert.org.tw/en/cp-139-10005-05e0f-2.html
https://www.twcert.org.tw/tw/cp-132-10004-99474-1.html

Get alerted when CVE-2025-2150 or the next vulnerability affects your stack