CVE-2015-9276

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SmarterTools SmarterMail before 13.3.5535 was vulnerable to stored XSS by bypassing the anti-XSS mechanisms. It was possible to run JavaScript code when a victim user opens or replies to the attacker's email, which contained a malicious payload. Therefore, users' passwords could be reset by using an XSS attack, as the password reset page did not need the current password.

Metrics

CVSS 3.0 6.1/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Jan 16, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2015

CVE-2015-92779.1MailEnable before 8.60 allows Directory Traversal for reading the messages of other users, uploading files, and deleting files because "/../CVE-2015-92789.8MailEnable before 8.60 allows Privilege Escalation because admin accounts could be created as a consequence of %0A mishandling in AUTH.TAB aCVE-2015-92796.1MailEnable before 8.60 allows Stored XSS via malformed use of "<img/src" with no ">" character in the body of an e-mail message.CVE-2015-928010.0MailEnable before 8.60 allows XXE via an XML document in the request.aspx Options parameter.CVE-2015-92816.1Logon Manager in SAS Web Infrastructure Platform before 9.4M3 allows reflected XSS on the Timeout page.CVE-2015-92826.1The Pie Chart Panel plugin through 2019-01-02 for Grafana is vulnerable to XSS via legend data or tooltip data. When a chart is included in CVE-2015-92848.8The request phase of the OmniAuth Ruby gem (1.9.1 and earlier) is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on CVE-2015-92856.1esoTalk 1.0.0g4 has XSS via the PATH_INFO to the conversations/ URI.CVE-2015-92866.1Controllers.outgoing in controllers/index.js in NodeBB before 0.7.3 has outgoing XSS.CVE-2015-92879.8Directory Traversal was discovered in University of Cambridge mod_ucam_webauth before 2.0.2. The key identification field ("kid") of the IdPCVE-2015-92886.5The Unity Web Player plugin before 4.6.6f2 and 5.x before 5.0.3f2 allows attackers to read messages or access online services via a victim'sCVE-2015-92895.5In the Linux kernel before 4.1.4, a buffer overflow occurs when checking userspace params in drivers/media/dvb-frontends/cx24116.c. The maxi
CVE-2015-9276: Medium severity, CVSS 6.1 | Vulnix