CVE-2023-48114 | BDVDB-2026-220183 Detail

Description#

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://www.smartertools.com/smartermail/release-notes/current
https://co3us.gitbook.io/write-ups/stored-xss-in-email-body-of-smartermail-cve-2023-48114

Exploit#

No public exploit known

History#

Version 12023-12-21Record published in the CVE List.
Version 22024-08-02Most recent update recorded in the CVE List.